Questions tagged [dmarc]

DMARC (Domain-based Message Authentication, Reporting and Conformance) is an email authentication protocol. It is designed to give email domain owners the ability to protect their domain from unauthorized use, commonly known as email spoofing.

Filter by
Sorted by
Tagged with
2
votes
2answers
94 views

Why is DMARC failing when SPF and DKIM are passing?

I've seen this question asked before, but unfortunately, don't understand the responses. I think its something to do with "from" headers being defined differently by different standards. I've added ...
0
votes
1answer
70 views

DMARC “policy_evaluated” is “fail” for SPF, even when SPF domain alignment is “relaxed”?

A DMARC aggregate report which I received reads (irrelevant pieces removed, domains changed): <record> <row> <policy_evaluated> <disposition>none</...
3
votes
2answers
258 views

How did a phishing email pass SPF, DKIM and DMARC?

A friend received a spoofed email (from Bank of America using an uber.com address) which was correctly identified as 'spam' by Gmail. However, looking at the raw message it seems to have passed SPF, ...
1
vote
1answer
72 views

What is the reason for DMARC spec to not require specifically SPF or DKIM pass?

DMARC produces "pass" result if and only if at least one of SPF and DKIM checks pass. It has been noted that DKIM provides stronger protection of the two (if implemented properly). But, in order to ...
0
votes
1answer
193 views

Soft-fail vs Hard-fail SPF + Monitor vs Reject+Strict DMARC, could it be counterproductive?

I have a ProtonMail premium plan with one custom domain and a single email address. My domain DNS is protected with DNSSEC. What caught my eye were two things they recommended in the domain setup: ...
1
vote
1answer
41 views

Does a domain with no SPF record count as a DMARC pass or fail?

Learning about how SPF/DMARC work right now. What I don't see a lot of the articles covering is what happens if there is no published SPF record for the domain. From what I can see most mail servers ...
1
vote
2answers
93 views

SPF, DKIM and DMARC - How do receiving/recipient mail servers know how and when to validate the mail?

I have spent a bit of time researching SPF, DKIM and DMARC mechanisms however If I understand correctly, these help the recipient to confirm whether the domain is legitimate but only if they have ...
1
vote
1answer
306 views

Bypassing OpenDMARC checks by forging Authentication-Results

In order to have mail exchanger MX servers to be able to deliver mail to the primary MX, both SPF and DMARC checks needs to be bypassed when the connection is made from a secondary MX. For SPF this is ...
0
votes
2answers
174 views

DMARC on ProtonMail custom domain

I began using ProtonMail email service, I like it that much, that I connected my domain yesterday and did appropriate changes to DNS. This page of ProtonMail's knowledgebase says how DMARC shall be ...
0
votes
1answer
176 views

dkim passes under a different domain's dkim

I read that a SPF fail with DKIM pass means someone has forwarded an email with our domain name attached. I haven't sent any emails to this domain. Is this domain trying to send emails with my domain? ...
1
vote
1answer
160 views

Is it bad to use DKIM DNS without signing mails?

Does it provide any trust at all to have DKIM set up correctly in my DNS but not sign any emails? I could not find any information about that. Now, if I send an email to a domain/server with DMARC ...
0
votes
1answer
222 views

DMARC and SPF are setup for my non-www domain but doesn't work for www

My website is up and running on www.example.com and I am sending automated emails from my email address support@example.com. DMARC and SPF seem to setup accordingly: _dmarc : v=DMARC1;p=none;pct=100;...
0
votes
1answer
576 views

How should I configure DMARC (or DKIM?) to deal with OWA forwarding changing email bodies?

For my own domain (mydomain.com, hosted with a free G Suite), I have setup DMARC in testing mode: v=DMARC1; p=none; sp=reject; aspf=s; adkim=s; rua=mailto:dmarc@mydomain.com I have sent out test ...
0
votes
1answer
239 views

What is the SPF domain value based on in DMARC aggregate reports?

As I'm reading DMARC aggregate reports, I've come across a few records that have <auth_results><spf><domain> values that don't match the envelope from, header from, or source IP ...
1
vote
1answer
167 views

How to disable email for a subdomain without using SPF

I am working on a tool that checks SPF records, and would like a way to be able to disable email from a testing subdomain, and its children, so that my test domains are not easy targets for spammers ...
3
votes
0answers
794 views

How to set header.from?

A client recently received an email that was spoofed in a way that I'd never seen before. The following are the anonymised, relevant details from the email's headers: authentication-results: spf=none ...
0
votes
0answers
168 views

Where can I find sample DMARC failure reports?

I want to automate ingestion of DMARC failure reports, both aggregate and forensic. Unfortunately, I don't have a mailbox set up to collect them yet. Does anyone know where I can find sample DMARC ...
1
vote
2answers
680 views

DMARC none policy overwrites local policy

DMARC is used to tell receivers of e-mail what to do if SPF or DKIM fails in mails send from your domain. As far as I know this pretty much sums up DMARC, if this is not correct please correct me. My ...
2
votes
2answers
449 views

DMARC policy result when exactly one of SPF and DKIM fails and exactly one succeeds

E-mail forwarding can break SPF, but it should not break DKIM. I want to make a DMARC policy that will evaluate to "pass" when either DKIM or SPF passes, and "fail" when neither DKIM or SPF passes. ...
3
votes
1answer
390 views

Understand DMARC report before starting quarantine

I work for a small company. We have lot of IP black listed because of spamming. We decided to setup dmarc for our mail server. This has been setup and is working correctly. The issue now is that in ...
4
votes
1answer
384 views

Why set up DMARC for SPF if it's already set up for DKIM?

I have SPF and DKIM. I'm planning on adding DMARC to tell receivers to expect SPF and/or DKIM. I've read that it's best to set DMARC up with both SPF and DKIM, but I don't understand exactly when ...
2
votes
1answer
3k views

Dmarc: Why do I have dkim=fail, spf=fail and result=pass

I have set up my company dmarc. It is in test mode and I regularly receive reports. Some seem weird to me and I would like to understand. For example, I have received a report with SPF and dkim failed,...
1
vote
1answer
1k views

How to read dmarc record for a report?

I have a dmarc file containing some record. I am bit surprised by the result and I would like to make sure I am reading it correctly. Here is the record: <record> <row> &...
0
votes
1answer
60 views

Why is DKIM configuration testing not working the same for every test site?

basically, I have setup spk, dkim and dmarc for mail authentication. For this, I used this tuto. All worked correctly and I got this result: seems like everything OK. Now to confirm everything is ...
1
vote
1answer
112 views

How to test dmarc in a closed environment?

I would like to setup email authentication for my company Exchange server. Since this is production I don't want to break something. I want to test this first in virtual machines and when I am sure it ...
3
votes
2answers
1k views

DMARC/SPF/DKIM - forward quarantine emails to a separate email address

Is there a way with DMARC/SPF/DKIM to forward all emails that fail DMARC to an email address I specify? Ie, if someone tries to spoof an email saying it's from me, and it fails, I'd like that email ...
3
votes
1answer
215 views

What does a failed SPF record tell me from a DMARC Aggregate report?

I just started receiving DMARC aggregate reports. I am trying to understand what it means for a Source IP to fail SPF. Does this mean that the domain that failed the SPF tried to send an email on ...
0
votes
4answers
155 views

Suspicious Entry in DMARC Report

I recently contacted a vendor of security-related development libraries to ask for a quote (I won't name them yet). The next day, Postmark sent me my weekly DMARC report - and it contained 2 failed ...
1
vote
1answer
79 views

Verify senders of earlier emails in chain

I know that an emails' sender can be verified e.g. through DKIM. If I receive an email chain containing replies, forwards, etc. is there any way to verify the sender of other (earlier) emails in the ...
3
votes
1answer
149 views

Are high levels of email spam normal?

I have got my SPF, DKIM & DMARC records correctly setup and I have started using a DMARC analysis service. One thing I have noticed is the volume failures. For example, in the last 3 days I have ...
0
votes
2answers
605 views

Why did spoof email receive a “pass”? And why didn't it show up in the aggregate report?

Good Morning All, I've been thrown into the deep end with a request from my director. I know little of DMARC and email spoofing in general, but I'm trying to somehow weed out WHY this spoof email "...
1
vote
1answer
352 views

Why so many DMARC failures? When to move on?

I just started getting DMARC aggregate reports for our newly-DKIM'd environment in passive mode ("p=none;") and notice a strange trend: Almost 1/4 of the IPs in any given provider report DKIM auth ...