3

I recently migrated my DNS servers and added DMARC entries. However, DMARC reports are completely new to me.

Today I received a DMARC report purportedly from Yahoo, and I'm not sure if I should open the attachment. I assumed DMARC reports should have come from my own domain, not a "receiving" domain. But according to DMARC FAQ, "DMARC also provides a way for the email receiver to report back to the sender about messages".

So, are DMARC reports sent by both sender and receiver? Should I believe the attachment legitimately came from Yahoo?

2 Answers 2

3

DMARC is defined by RFC 7489.

It has this:

6.6. Mail Receiver Actions

This section describes receiver actions in the DMARC environment.

[..]

6.6.5. Store Results of DMARC Processing

The results of Mail Receiver-based DMARC processing should be stored for eventual presentation back to the Domain Owner in the form of aggregate feedback reports. Sections 6.3 and 7.2 discuss aggregate feedback.

§6.3 defines the syntax and says:

rua: Addresses to which aggregate feedback is to be sent (comma- separated plain-text list of DMARC URIs; OPTIONAL).

ruf: Addresses to which message-specific failure information is to be reported (comma-separated plain-text list of DMARC URIs; OPTIONAL). If present, the Domain Owner is requesting Mail Receivers to send detailed failure reports about messages that fail the DMARC evaluation in specific ways (see the "fo" tag above).

Section 7 is fully devoted to "DMARC Feedback". So yes, in short, the receiving end is expected to follow rua/ruf if present and hence they are the sources of this report.

As to validate if any given email is indeed coming from Yahoo, you have to rely on traditional validating mechanisms, that is taking into account, if any, SPF/DKIM/DMARC from the receiving end of your emails that is now the sending end of the feedback report back to you.

Make sure to have a look at §7.1 that describes some protection the sender of the feedback report should follow, and the use of the _report._dmarc DNS record.

Note that both the errors and the aggregate feedback reports have specific format to follow, so you can check that to segregate valid ones from non valid ones.

1
  • Thank you. I appreciate the clear explanation and RFC.
    – Trebor
    Sep 21 at 15:47
2

DMARC reports are prepared and sent by servers that receive your emails.

They won't come from your domain because they're not emails from you.

In a nutshell, those email servers sending DMARC reports are configured to do DMARC checks, apply DMARC policies, and record the disposition (outcome of emails -- deliver, quarantine, reject). This last step is done only for those domains on which DMARC record indicates that reporting is desired (i.e. having a rua= tag).

Periodically (usually daily), those email servers aggregate all disposition records per domain, generate the DMARC report in XML format, and send them out to whoever was present in the rua= tag.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.