3

We are recently deploying DMARC and seeking additional details about an issue. DMARC is configured in the most basic way:

v=DMARC1; p=none; rua=mailto:[email protected]

Our primary server signs outgoing messages with DKIM keys but the first report we received this morning shows approximately 25% of those messages failing both authentication and alignment.

When I inspect headers on messages we are sending everything appears to be in order. I can't understand why only some of the messages would fail if DKIM is configured properly. Could this be related to forwarding? How can i find out? I looked into adding forensic reporting but apparently there are almost no providers that support it.

What would cause this and how can I investigate which messages are failing authentication?

1 Answer 1

2

What would cause this [25% of those messages failing both authentication and alignment]...

Failing authentication is obvious. DKIM signatures in emails don't validate.

Failing DMARC alignments means that the DKIM signature is from a different domain that the one in the "From" header. Check the d= tag in the DKIM-Signature header. It must match the "From" address for DMARC to pass.

...Could this be related to forwarding?

Yes.

...and how can I investigate which messages are failing authentication?

It is on your DMARC reports. More specifically, the reports contain who is sending with a "From" using your domain, who is using which DKIM selector, SPF domains checked, and which one is passing and which is not.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.