I get a lot of DMARC feedback from accounts/websites I don't have contact with and want some clarity on if I should be taking any action or if these feedback reports are informative of any serious issues?
I run a WHM server and use SPF and DKIM (and _DMARC), all emails are sent from the same domain server.
An example DNS setup for my _DMARC (and DKIM and SPF):
mydomain.co.uk 14400 IN TXT "v=spf1 mx a ip4:188.8.131.52 ip4:184.108.40.206 ~all" default._domainkey 14400 IN TXT "v=DKIM1; k=rsa; p=<code>; _dmarc 14400 IN TXT "v=DMARC1; p=quarantine; sp=none; rua=mailto:email@example.com!90m; ruf=mailto:firstname.lastname@example.org; rf=afrf; pct=100; ri=86400"
and as far as I can tell this is set up and works as expected.
however, I get quite a few automatic messages from various domains across the world wide web, which have nothing to do with my domain. I am the only person using emails from my domain, no one else is emailing from my domain.
For example, this morning I received a DMARC aggregate report from Comcast stating:
<?xml version="1.0" encoding="UTF-8" ?> <feedback> <version>1.0</version> <report_metadata> <org_name>comcast.net</org_name> <email>email@example.com</email> <report_id>v1-1483425166-mydomain.co.uk</report_id> <date_range> <begin>1483315200</begin> <end>1483401600</end> </date_range> </report_metadata> <policy_published> <domain>mydomain.co.uk</domain> <adkim>r</adkim> <aspf>r</aspf> <p>quarantine</p> <sp>none</sp> <pct>100</pct> <fo>0</fo> </policy_published> <record> <row> <source_ip>220.127.116.11</source_ip> <count>1</count> <policy_evaluated> <disposition>none</disposition> <dkim>fail</dkim> <spf>fail</spf> </policy_evaluated> </row> <identifiers> <header_from>mydomain.co.uk</header_from> </identifiers> <auth_results> <spf> <domain>bounce.secureserver.net</domain> <scope>mfrom</scope> <result>pass</result> </spf> </auth_results> </record> </feedback>
No I don't recognise any of the details set out here aside from my domain, the IP address give in
<source_ip> is not my IP address and I am unaware of having any contact at all with Comcast.
Basically, I get quite a lot of these notices and I can't find any feedback as to tell me if they're just informative and can be forgotten about (in which case what's the point of them?) or if I can do something with my server to improve the failings that the notice informs me of.
- Are these reports something that can be acted upon?
- How Should DMARC reports such as these be acted upon at my end?
- Are these reports indicators of any form of account compromise
- can/does the number of these reports [potentially] reflect badly upon my domain name to the rest of the 'web?
It may be worth noting I suspect the answer to the last two bullets to both be "No", But I'm not an expert on these.
I have already read this post as well as the DMARC FAQ and this topic, but there's not much info. on how we're meant to react to aggregate reports. I am aware that "failed" DMARC reports can be caused by mail forwarding programs, although I hope to negate this possibility with my SPF
Overall I think I shouldn't need to worry about these reports but I would like a second opinion due to what I perceive as the regularity and (I think) relatively significant number of aggregate reports I'm receiving.