Questions tagged [dmarc]

DMARC (Domain-based Message Authentication, Reporting and Conformance) is an email authentication protocol. It is designed to give email domain owners the ability to protect their domain from unauthorized use, commonly known as email spoofing.

Filter by
Sorted by
Tagged with
4
votes
1answer
392 views

Why set up DMARC for SPF if it's already set up for DKIM?

I have SPF and DKIM. I'm planning on adding DMARC to tell receivers to expect SPF and/or DKIM. I've read that it's best to set DMARC up with both SPF and DKIM, but I don't understand exactly when ...
3
votes
2answers
283 views

How did a phishing email pass SPF, DKIM and DMARC?

A friend received a spoofed email (from Bank of America using an uber.com address) which was correctly identified as 'spam' by Gmail. However, looking at the raw message it seems to have passed SPF, ...
3
votes
1answer
398 views

Understand DMARC report before starting quarantine

I work for a small company. We have lot of IP black listed because of spamming. We decided to setup dmarc for our mail server. This has been setup and is working correctly. The issue now is that in ...
3
votes
3answers
154 views

Why is DMARC failing when SPF and DKIM are passing?

I've seen this question asked before, but unfortunately, don't understand the responses. I think its something to do with "from" headers being defined differently by different standards. I've added ...
3
votes
2answers
1k views

DMARC/SPF/DKIM - forward quarantine emails to a separate email address

Is there a way with DMARC/SPF/DKIM to forward all emails that fail DMARC to an email address I specify? Ie, if someone tries to spoof an email saying it's from me, and it fails, I'd like that email ...
3
votes
1answer
149 views

Are high levels of email spam normal?

I have got my SPF, DKIM & DMARC records correctly setup and I have started using a DMARC analysis service. One thing I have noticed is the volume failures. For example, in the last 3 days I have ...
3
votes
0answers
828 views

How to set header.from?

A client recently received an email that was spoofed in a way that I'd never seen before. The following are the anonymised, relevant details from the email's headers: authentication-results: spf=none ...
3
votes
1answer
216 views

What does a failed SPF record tell me from a DMARC Aggregate report?

I just started receiving DMARC aggregate reports. I am trying to understand what it means for a Source IP to fail SPF. Does this mean that the domain that failed the SPF tried to send an email on ...
2
votes
2answers
454 views

DMARC policy result when exactly one of SPF and DKIM fails and exactly one succeeds

E-mail forwarding can break SPF, but it should not break DKIM. I want to make a DMARC policy that will evaluate to "pass" when either DKIM or SPF passes, and "fail" when neither DKIM or SPF passes. ...
2
votes
1answer
3k views

Dmarc: Why do I have dkim=fail, spf=fail and result=pass

I have set up my company dmarc. It is in test mode and I regularly receive reports. Some seem weird to me and I would like to understand. For example, I have received a report with SPF and dkim failed,...
1
vote
1answer
44 views

Does a domain with no SPF record count as a DMARC pass or fail?

Learning about how SPF/DMARC work right now. What I don't see a lot of the articles covering is what happens if there is no published SPF record for the domain. From what I can see most mail servers ...
1
vote
2answers
725 views

DMARC none policy overwrites local policy

DMARC is used to tell receivers of e-mail what to do if SPF or DKIM fails in mails send from your domain. As far as I know this pretty much sums up DMARC, if this is not correct please correct me. My ...
1
vote
2answers
96 views

SPF, DKIM and DMARC - How do receiving/recipient mail servers know how and when to validate the mail?

I have spent a bit of time researching SPF, DKIM and DMARC mechanisms however If I understand correctly, these help the recipient to confirm whether the domain is legitimate but only if they have ...
1
vote
1answer
1k views

How to read dmarc record for a report?

I have a dmarc file containing some record. I am bit surprised by the result and I would like to make sure I am reading it correctly. Here is the record: <record> <row> &...
1
vote
1answer
79 views

Verify senders of earlier emails in chain

I know that an emails' sender can be verified e.g. through DKIM. If I receive an email chain containing replies, forwards, etc. is there any way to verify the sender of other (earlier) emails in the ...
1
vote
1answer
355 views

Why so many DMARC failures? When to move on?

I just started getting DMARC aggregate reports for our newly-DKIM'd environment in passive mode ("p=none;") and notice a strange trend: Almost 1/4 of the IPs in any given provider report DKIM auth ...
1
vote
1answer
79 views

What is the reason for DMARC spec to not require specifically SPF or DKIM pass?

DMARC produces "pass" result if and only if at least one of SPF and DKIM checks pass. It has been noted that DKIM provides stronger protection of the two (if implemented properly). But, in order to ...
1
vote
1answer
356 views

Bypassing OpenDMARC checks by forging Authentication-Results

In order to have mail exchanger MX servers to be able to deliver mail to the primary MX, both SPF and DMARC checks needs to be bypassed when the connection is made from a secondary MX. For SPF this is ...
1
vote
1answer
169 views

How to disable email for a subdomain without using SPF

I am working on a tool that checks SPF records, and would like a way to be able to disable email from a testing subdomain, and its children, so that my test domains are not easy targets for spammers ...
1
vote
1answer
117 views

How to test dmarc in a closed environment?

I would like to setup email authentication for my company Exchange server. Since this is production I don't want to break something. I want to test this first in virtual machines and when I am sure it ...
1
vote
1answer
166 views

Is it bad to use DKIM DNS without signing mails?

Does it provide any trust at all to have DKIM set up correctly in my DNS but not sign any emails? I could not find any information about that. Now, if I send an email to a domain/server with DMARC ...
0
votes
4answers
158 views

Suspicious Entry in DMARC Report

I recently contacted a vendor of security-related development libraries to ask for a quote (I won't name them yet). The next day, Postmark sent me my weekly DMARC report - and it contained 2 failed ...
0
votes
2answers
621 views

Why did spoof email receive a “pass”? And why didn't it show up in the aggregate report?

Good Morning All, I've been thrown into the deep end with a request from my director. I know little of DMARC and email spoofing in general, but I'm trying to somehow weed out WHY this spoof email "...
0
votes
2answers
194 views

DMARC on ProtonMail custom domain

I began using ProtonMail email service, I like it that much, that I connected my domain yesterday and did appropriate changes to DNS. This page of ProtonMail's knowledgebase says how DMARC shall be ...
0
votes
1answer
94 views

DMARC “policy_evaluated” is “fail” for SPF, even when SPF domain alignment is “relaxed”?

A DMARC aggregate report which I received reads (irrelevant pieces removed, domains changed): <record> <row> <policy_evaluated> <disposition>none</...
0
votes
1answer
278 views

Soft-fail vs Hard-fail SPF + Monitor vs Reject+Strict DMARC, could it be counterproductive?

I have a ProtonMail premium plan with one custom domain and a single email address. My domain DNS is protected with DNSSEC. What caught my eye were two things they recommended in the domain setup: ...
0
votes
1answer
594 views

How should I configure DMARC (or DKIM?) to deal with OWA forwarding changing email bodies?

For my own domain (mydomain.com, hosted with a free G Suite), I have setup DMARC in testing mode: v=DMARC1; p=none; sp=reject; aspf=s; adkim=s; rua=mailto:dmarc@mydomain.com I have sent out test ...
0
votes
1answer
248 views

What is the SPF domain value based on in DMARC aggregate reports?

As I'm reading DMARC aggregate reports, I've come across a few records that have <auth_results><spf><domain> values that don't match the envelope from, header from, or source IP ...
0
votes
1answer
60 views

Why is DKIM configuration testing not working the same for every test site?

basically, I have setup spk, dkim and dmarc for mail authentication. For this, I used this tuto. All worked correctly and I got this result: seems like everything OK. Now to confirm everything is ...
0
votes
1answer
192 views

dkim passes under a different domain's dkim

I read that a SPF fail with DKIM pass means someone has forwarded an email with our domain name attached. I haven't sent any emails to this domain. Is this domain trying to send emails with my domain? ...
0
votes
1answer
227 views

DMARC and SPF are setup for my non-www domain but doesn't work for www

My website is up and running on www.example.com and I am sending automated emails from my email address support@example.com. DMARC and SPF seem to setup accordingly: _dmarc : v=DMARC1;p=none;pct=100;...
0
votes
0answers
168 views

Where can I find sample DMARC failure reports?

I want to automate ingestion of DMARC failure reports, both aggregate and forensic. Unfortunately, I don't have a mailbox set up to collect them yet. Does anyone know where I can find sample DMARC ...