Unknown IPs on DMARC report

Question

I've signed up to recieve DMARC reports from https://dmarc.postmarkapp.com/

I have setup my email service (Sendgrid) in my DNS so all emails I send are passing DMARC. My email address is using gmail with my own domain name.

However, there are several thousand emails failing, and they appear to be sent from random IP addresses and hosts. What would be causing this? I only send via Sendgrid and 1 or 2 email directly from gmail. I am concerned that a) someone is sending spam from my email address and b) that my email address will be blacklisted and all future emails will go to spam.

Answer 1

This is just bot activity. Infected hosts are forging your domain to send spam or malware.

SPF, DKIM, and DMARC are the technologies used to combat the problem. It seems like you've already deployed those so there's nothing to worry about (beyond that latent existential dread that comes from running services on the internet). You're not going to get blocked as you're not the one sending the spam. If having your domain forged by botnets was enough to get blocked, every domain on the internet would be blocked instantly.

Answer 2

These unknown IPs may appear because of different reasons:

• As pointed in the previous answer it may be a malicious sender or spam bot activity.
• It may be a result of an authorized email sent from your domain. After it passes DKIM, DMARC and SPF the recipient may have a rule that automatically forwards your email to some other address, rewriting the Return-Path email header. You will see in your report an address that passed DMARC and DKIM, but failed SPF.
• As pointed in the answers to this similar question it also may be a result of legitimate G Suite Groups or Google Calendar activity.