Skip to main content

Questions tagged [dmarc]

DMARC (Domain-based Message Authentication, Reporting and Conformance) is an email authentication protocol. It is designed to give email domain owners the ability to protect their domain from unauthorized use, commonly known as email spoofing.

Filter by
Sorted by
Tagged with
0 votes
1 answer
121 views

Can I use multiple email providers with my website's DKIM, DMARC and SPF?

I'm a software developer, with limited Mail server setup experience, running a little side SAAS on the side where I send emails to my customers. My domain has SPF, DMARC and DKIM setup and I use ...
LePrinceDeDhump's user avatar
1 vote
2 answers
115 views

DKIM Authorization Question

I've read a good bit about DMARC, DKIM, and SPF but now that I'm getting results come in, there are some things I'm seeing that I don't understand. I keep seeing passing DKIM results from outside ...
mirkaim's user avatar
  • 21
3 votes
1 answer
189 views

How to know whether e-mail was spoofed?

I am having a hard time understanding the different methods of e-mail verification. I know about DKIM, SPF and DMARC. If I would like to know whether an e-mail I received actually came from the e-...
LAWYLAWY's user avatar
1 vote
0 answers
178 views

Is my DMARC report saying legitmate emails are failing or illegitimate emails are passing? [closed]

I am learning how to improve email deliverability. Along the way, I'm learning about DMARC reports, SPF and DKIM. I have a friend with a small business who said I can practice with this email ...
learningtech's user avatar
6 votes
1 answer
2k views

Spoofed email sent to me from my email address with SPF/DKIM/DMARC passing

I received an email earlier today on my work email address. The email came from the same address—mine—but I didn't send it. It was an email claiming that he was a professional hacker who had hacked my ...
PaulMcF87's user avatar
  • 161
1 vote
1 answer
1k views

Still able to spoof emails with strict DMARC, SPF and DKIM enabled

Despite setting up strict DMARC, SPF, and having DKIM enabled, I am still easily able to spoof the "From" address. I can easily do this with PHPMailer on my Mac and even with some free 3rd ...
Ian W's user avatar
  • 111
0 votes
1 answer
272 views

Spoofed forwarded email? Help with analyzing of DMARC report

Why did this email get forwarded successfully? An XML report is below: I simply cannot understand the delivery status, a transcript follows: This email has been automatically forwarded. Despite the ...
Vlastimil Burián's user avatar
1 vote
2 answers
329 views

dmarc privacy concern with microsoft reports

I run the the email for several domains and receive the domain reports on their behalf. Google is our email provider. enterprise.protection.outlook.com, sends aggregate reports with an envelope_to ...
Juan's user avatar
  • 119
17 votes
3 answers
3k views

"Undelivered Mail" I never sent (after registration on website)

I created an online account and received the usual welcome email. In addition, however, an "Undelivered Mail Returned to Sender" email appeared in my inbox one second later. I am the ...
S. G.'s user avatar
  • 173
2 votes
1 answer
326 views

Spoofed email: whose fault is it?

My relative received an email from a bill they were expecting to pay. So they paid said bill. Only problem is: it was a spoofed email, and the real bill only came in later. I checked the email on the ...
Bersan's user avatar
  • 133
0 votes
1 answer
2k views

DKIM from another domain, how does it work?

I've recently started configuringn and using DMARC reports and I have the following question. How can the DKIM domain not be my domain (and pass)? I have the following report <record> <row&...
mb14's user avatar
  • 103
2 votes
0 answers
2k views

DKIM/SPF What does it mean when policy_evaluated fails but auth_results passes?

I am trying to get the DKIM and SPF settings correct for a client who uses both GSuite and WordPress to send her emails. I added this dmarc: v=DMARC1; p=none; rua=mailto:l***@******ney.com; fo=1; ...
OM4U's user avatar
  • 21
7 votes
1 answer
1k views

Can DMARC's SPF alignment be spoofed?

IP addresses can be spoofed. The Envelope-From and Header-From addresses can be spoofed as well. But is it possible to spoof all three at the same time to send a forged email that passes both SPF and ...
hilltothesouth's user avatar
0 votes
1 answer
151 views

DMARC falsely reports impersonation

I have set up DMARC for some months now and I am using dmarc-visualizer to parse the reports. Overall I am happy so we can advance towards BIMI, but before switching to quarantine or reject on DMARC, ...
Alex's user avatar
  • 1
1 vote
1 answer
400 views

Why is DMARC Passing, when it seems like there is no alignment?

I have set adkim=s and aspf=s, the DMARC check on mxtoolbox.com passes all tests. However, I'm using the default DKIM from microsoft, so from my understanding DMARC should fail since the alignment ...
Esteban's user avatar
  • 133
1 vote
1 answer
267 views

Authorizing 3rd Party Envelope Sender to Impersonate Header Sender

Rewriting for clarity: This is regarding emails send from a 3rd party marketer spoofing one of our email addresses in the message header from field. In these emails the envelope sender would come ...
Neobane's user avatar
  • 11
0 votes
1 answer
599 views

How did the email pass DKIM?

I am trying to figure out how this one phishing email (used our Company's domain as from) was able to bypass the O365 Spamfilter. Looking at the Header it looks like they passed the DKIM even though ...
Lephas's user avatar
  • 3
4 votes
2 answers
3k views

How to fix DMARC alignment failure

I'm sending emails via the Ionos mail servers. I've got spf set up, but dmarc still fails. This seems related to: Why is DMARC failing when SPF and DKIM are passing? But I can't figure out how to fix ...
danielmoessner's user avatar
37 votes
2 answers
21k views

How did this paypal spoof email pass SPF, DKIM and DMARC

This mail that got through has me stumped. It appeared to me as being from PayPal <[email protected]> in my Inbox. I happened to look at the original and it says SPF, DKIM and DMARC ...
ianw's user avatar
  • 401
2 votes
1 answer
206 views

DMARC aggregated report SPF domain field

I am trying to identify, why some of my e-mails are being marked as spam by recipients, and have therefore set up SPF and DKIM. In order to check that they can be verified, I set up aggregated DMARC ...
Tom's user avatar
  • 484
0 votes
1 answer
385 views

Rejected because of DKIM check fail; alignment check fail

I am testing my mail server setup with this tool https://email-test.had.dnsops.gov/ and I am getting suspicious that the tool may not be working right. From what I understand it reports that my ...
MeSo2's user avatar
  • 105
0 votes
0 answers
421 views

Unknown Cause of SPF Fail

I have the following SPF record: v=spf1 include:_spf.mailspamprotection.com include:_spf.google.com ip4:209.85.220.0/24 ~all Although I have included _spf.mailspamprotection.com in my SPF record, ...
Reza's user avatar
  • 101
-1 votes
1 answer
192 views

Does gmail use SPF or DMARC when sending messages outside of gmail?

I can't seem to find any record of SPF or DMARC in the original messages coming from gmail to my mail server. Does gmail use SPF or DMARC when sending messages outside of gmail?
johnnyApplePRNG's user avatar
4 votes
3 answers
574 views

What is the point of having SPF and DKIM set up, but having DMARC with policy=none?

Under this FAQ it says that using policy=none is a way for domain owners to monitor forged emails, without having to set up SPF/DKIM. But what im wondering, because i dont fully understand what SPF/...
Flying Thunder's user avatar
2 votes
2 answers
742 views

Do fowarded emails retain DMARC protection?

Assume I ask someone to create a filter in their Gmail account that automatically forwards certain emails to my inbox. If the original email was protected with DMARC, would the forwarded email also be ...
Bradford Griggs's user avatar
0 votes
0 answers
36 views

Why do I need DMARC on top of SPF and DKIM? [duplicate]

If SPF is verifying against a set of IP records if the incoming email from a domain was sent from an authorized host piggybacking on the DNS and DKIM does touch the signature of the email and ...
Asian Flavor's user avatar
0 votes
1 answer
1k views

Whitelisting Email Service for Anti-Spoofing and DMARC

My company uses an Anti-Spoofing Protection based on the SPF Record and has implemented DMARC. Often our users correspond via a "secure" messaging platform like Proofpoint/ZIX/IronPort from ...
user2942358's user avatar
1 vote
1 answer
153 views

Email "FROM address" is changed to an unexpected email address

I have enabled DMARC settings in my domain (drkotzi.org). Now when I send emails from my email address ([email protected]) to email lists or email groups, I can see that the email's from address and ...
yello_flash's user avatar
2 votes
2 answers
304 views

DMARC rua indicates mail send from competitorDomain.com for ourDomain.com, is this (potentially) mallicous?

We've received several rua reports indicating that one of our direct competitors is sending emails with our domain in the mail from headers. I do not have access to the actual emails sources, and I ...
Jacco's user avatar
  • 7,712
1 vote
1 answer
3k views

SPF/DMARC for shared email provider (gmail) - how did this email pass SPF?

We recently received an email from a self described "white hat hacker" purporting to be from our own organization. According to the mail headers, spf, dmarc, dkim and arc all passed okay and ...
Dave Smylie's user avatar
4 votes
1 answer
2k views

Does gmail still ignore DKIM if SPF passes, DMARC style?

This blog post from 2016 shockingly implies that gmail will accept an email if either SPF or DKIM passes. We use G suite SMTP servers, therefore SPF provides almost zero protection from spoofing. Is ...
Morrison's user avatar
8 votes
1 answer
7k views

Enforcing DMARC policy (reject) on an Office 365 tenant

The domain & tenant has SPF and DKIM properly configured and DMARC policy set to p=reject. Still, emails spoofed with the domain in the From header aren't rejected, but appear in the Junk Email ...
Esa Jokinen's user avatar
  • 19.1k
1 vote
1 answer
265 views

DMARC & failing SPF

I would like to clarify the following scenario with DMARC, (assuming there is a publish DMARC policy): SPF fails No (aligned or any) DKIM records Should result of DMARC check be none or fail? ...
charlag's user avatar
  • 113
0 votes
0 answers
45 views

Do we need SPF when we have DKIM? [duplicate]

I always thought that to authenticate email we needed both SPF and DKIM (and DMARC). But email is confusing and recently I found myself asking why we can't do with just SPF or DKIM. I then discovered ...
SWdV's user avatar
  • 199
2 votes
2 answers
3k views

DMARC report for mails I didn't send

I set up DKIM, DMARC and SPF on my domain/server a few years ago, and never touched it again since then. Here are my DNS records (my domain is mydomain.com and my IP addresses are 1.1.1.1 and 2001::1)...
Foo's user avatar
  • 23
8 votes
3 answers
17k views

Why is DMARC failing when SPF and DKIM are passing?

I've seen this question asked before, but unfortunately, don't understand the responses. I think its something to do with "from" headers being defined differently by different standards. I've added ...
Dedicated Managers's user avatar
7 votes
1 answer
7k views

DMARC "policy_evaluated" is "fail" for SPF, even when SPF domain alignment is "relaxed"?

A DMARC aggregate report which I received reads (irrelevant pieces removed, domains changed): <record> <row> <policy_evaluated> <disposition>none</...
Konstantin Shemyak's user avatar
7 votes
2 answers
2k views

How did a phishing email pass SPF, DKIM and DMARC?

A friend received a spoofed email (from Bank of America using an uber.com address) which was correctly identified as 'spam' by Gmail. However, looking at the raw message it seems to have passed SPF, ...
Islay's user avatar
  • 591
3 votes
2 answers
266 views

What is the reason for DMARC spec to not require specifically SPF or DKIM pass?

DMARC produces "pass" result if and only if at least one of SPF and DKIM checks pass. It has been noted that DKIM provides stronger protection of the two (if implemented properly). But, in ...
Konstantin Shemyak's user avatar
0 votes
1 answer
2k views

Soft-fail vs Hard-fail SPF + Monitor vs Reject+Strict DMARC, could it be counterproductive?

I have a ProtonMail premium plan with one custom domain and a single email address. My domain DNS is protected with DNSSEC. What caught my eye were two things they recommended in the domain setup: ...
Vlastimil Burián's user avatar
1 vote
1 answer
756 views

Does a domain with no SPF record count as a DMARC pass or fail?

Learning about how SPF/DMARC work right now. What I don't see a lot of the articles covering is what happens if there is no published SPF record for the domain. From what I can see most mail servers ...
trallgorm's user avatar
  • 885
1 vote
2 answers
330 views

SPF, DKIM and DMARC - How do receiving/recipient mail servers know how and when to validate the mail?

I have spent a bit of time researching SPF, DKIM and DMARC mechanisms however If I understand correctly, these help the recipient to confirm whether the domain is legitimate but only if they have ...
Chaplin's user avatar
  • 13
3 votes
2 answers
3k views

Bypassing OpenDMARC checks by forging Authentication-Results

In order to have mail exchanger MX servers to be able to deliver mail to the primary MX, both SPF and DMARC checks needs to be bypassed when the connection is made from a secondary MX. For SPF this is ...
Esa Jokinen's user avatar
  • 19.1k
0 votes
2 answers
1k views

DMARC on ProtonMail custom domain

I began using ProtonMail email service, I like it that much, that I connected my domain yesterday and did appropriate changes to DNS. This page of ProtonMail's knowledgebase says how DMARC shall be ...
Vlastimil Burián's user avatar
1 vote
1 answer
649 views

dkim passes under a different domain's dkim

I read that a SPF fail with DKIM pass means someone has forwarded an email with our domain name attached. I haven't sent any emails to this domain. Is this domain trying to send emails with my domain? ...
euclid4's user avatar
  • 13
1 vote
1 answer
472 views

Is it bad to use DKIM DNS without signing mails?

Does it provide any trust at all to have DKIM set up correctly in my DNS but not sign any emails? I could not find any information about that. Now, if I send an email to a domain/server with DMARC ...
Hannes's user avatar
  • 13
1 vote
1 answer
969 views

DMARC and SPF are setup for my non-www domain but doesn't work for www

My website is up and running on www.example.com and I am sending automated emails from my email address [email protected]. DMARC and SPF seem to setup accordingly: _dmarc : v=DMARC1;p=none;pct=100;...
senty's user avatar
  • 113
0 votes
1 answer
1k views

How should I configure DMARC (or DKIM?) to deal with OWA forwarding changing email bodies?

For my own domain (mydomain.com, hosted with a free G Suite), I have setup DMARC in testing mode: v=DMARC1; p=none; sp=reject; aspf=s; adkim=s; rua=mailto:[email protected] I have sent out test ...
bers's user avatar
  • 240
1 vote
1 answer
576 views

What is the SPF domain value based on in DMARC aggregate reports?

As I'm reading DMARC aggregate reports, I've come across a few records that have <auth_results><spf><domain> values that don't match the envelope from, header from, or source IP ...
Sean W.'s user avatar
  • 845
1 vote
1 answer
495 views

How to disable email for a subdomain without using SPF

I am working on a tool that checks SPF records, and would like a way to be able to disable email from a testing subdomain, and its children, so that my test domains are not easy targets for spammers ...
jrtapsell's user avatar
  • 3,197