9
votes
Accepted
Why is google.com trying to send emails from my domain?
Short Answer: You're seeing internally routed emails in your DMARC reports, for recipient domains hosted on Google GSuite.
From the screenshot you share, it seems like these emails sent from Google ...
- 490
5
votes
MxToolbox says dmarc DNS record is not found despite having one configured with NameCheap
According to Namecheap's documentation on TXT records:
Note: the domain name itself should not be included to the Host field.
Consequently, enter
dkim._domainkey instead of dkim._domainkey....
- 151
4
votes
Does DMARC Add Value Beyond Reports?
DMARC is a way to publish your domain sending practices, and the policy you want to apply to unauthorized senders.
In a nutshell, it is a way to stop forged email pretending to come from your domain.
...
- 101
4
votes
Accepted
Yahoo rejecting email after registrar change
The problem could be IP reputation. The message is rather clear. The specific IP address (209.182.201.150, I assume it's your mail server) is being rejected.
Plus, that IP address is present in at ...
- 1,133
4
votes
Setting up DKIM, SPF, and DMARC Records for Domains that You Won't Use for Email
If these domains are related to your company or brand, you want to prevent bad actors to be able to abuse these domains.
For SPF you may publish the following records in DNS:
@ IN TXT "v=spf1 -...
- 490
3
votes
Accepted
Clarification re who sends DMARC reports
DMARC is defined by RFC 7489.
It has this:
6.6. Mail Receiver Actions
This section describes receiver actions in the DMARC environment.
[..]
6.6.5. Store Results of DMARC Processing
The results of ...
- 8,485
3
votes
Why is google.com trying to send emails from my domain?
Did you accept or reject a Google calendar invite? The creator of the event will get an email from Google using your email address as 'from' address.
Might be the case for other services offered by ...
- 983
2
votes
DMARC failure on forwarded SharePoint Online emails
The way I understand it, DKIM and SPF are passing but DMARC is failing
because the header.d address does not match the header.from address.
Is that about right?
Yes it is. The same goes for SPF, ...
- 490
2
votes
Accepted
DMARC record without rua or ruf entry
In DMARC, rua and ruf are optional. In addition, pct defaults to 100.
So your record is valid, but you can further condense it without changing its meaning: v=DMARC1; p=reject.
Personally I feel ...
- 16.2k
2
votes
Why is G Suite passing DMARC when alignment fails?
DMARC requires either SPF or DKIM to produce a PASS result in alignment with the FROM domain.
Please see the RFC for DMARC, section 4.2:
DMARC's filtering function is based on whether the RFC5322....
- 490
2
votes
Accepted
Which email servers currently send DMARC aggregate reports - and which do not yet?
Here you can find a useful site on DMARC data providers, sorted on size.
The one big ESP missing from the list is Microsoft. Hotmail / Outlook.com used to send aggregate reports, but has stopped ever ...
- 490
2
votes
BIMI Validation failure
On a side note in regards to validation failures:
I've done some extensive testing on urls that contain query strings such as ?color=000 and they are returning as failed on nearly half of the ...
2
votes
Do subdomains inherit DKIM keys? Can a DKIM SDID for one domain be used to validly sign mail that appears to be sent from another domain?
There is no inheritance.
RFC 6376 §3.6.2.1:
All DKIM keys are stored in a subdomain named "_domainkey". Given a
DKIM-Signature field with a "d=" tag of "example.com" ...
- 8,485
2
votes
Does DMARC help deliverability or is it simply a reporting mechanism?
DMARC is more than just reporting. If you are absolutely 100% sure that you have set up DKIM and SPF correctly, you can just add a DMARC record:
_dmarc.example.com TXT "v=DMARC1; p=reject;&...
- 21
2
votes
How to handle duplicate DKIM selectors?
DKIM selectors are arbitrary strings. They're used to locate the corresponding public key on the DNS, and can virtually be anything that is valid as a DNS label.
Having said that, selectors provided ...
- 101
2
votes
Yahoo rejecting email after registrar change
UPDATE:
This problem currently appears to be resolved. Emails appear to be working again. It may have just been Yahoo or even blacklisting as Kate has suggested. It's not the first time we've seen ...
- 3,290
2
votes
Accepted
Doesn't DMARC expose your email address?
You are correct in that it does basically circumvent WHOIS privacy by making the email address you put there public. You have a couple options here:
If your registrar supports email forwarding, ...
- 16.2k
2
votes
Clarification re who sends DMARC reports
DMARC reports are prepared and sent by servers that receive your emails.
They won't come from your domain because they're not emails from you.
In a nutshell, those email servers sending DMARC reports ...
- 101
2
votes
Does DMARC Add Value Beyond Reports?
DMARC helps to:
Determine how you want email servers to handle validation factors in DKIM and SPF.
Provide an avenue to report others trying to forge emails using your domain.
For example, review ...
- 2,163
2
votes
Does DMARC Add Value Beyond Reports?
While SPF tells the internet where should your authentic emails originate from (IP addresses)
DKIM tells the internet the digital signature your authentic emails should contain.
The DMARC tells the ...
- 21
2
votes
Intermittent DKIM authentication failing
What would cause this [25% of those messages failing both authentication and alignment]...
Failing authentication is obvious. DKIM signatures in emails don't validate.
Failing DMARC alignments means ...
- 101
2
votes
Accepted
Setting up DMARC and DKIM for subdomains not hosted on the same server as the main domain
The subdomains may be hosted on server B, but DNS records are stored on the server where the nameservers are pointing.
So you should be setting them up on Server A.
- 8,511
1
vote
Can I replace rua entry with ruf in DMARC record?
The ruf directive is generally unsupported by email providers, so you will likely miss a lot of reports if you don't include an rua directive.
In other words, regardless of whether it's valid syntax ...
- 16.2k
1
vote
Accepted
Is there any way to create a redirect for a DMARC record?
DMARC record is in fact a DNS TXT record on name _dmarc at apex of zone.
As such, you can completely use a CNAME there:
_dmarc.client1.example. CNAME _dmarc_for_clients.provider.example.
_dmarc....
- 8,485
1
vote
Accepted
Is DMARC relaxed alignment for SPF/DKIM bad?
Relaxed Alignment let's you authenticate your FROM domain by using a subdomain in your DKIM signature (d=sub.domain.tld) or Return-Path address ([email protected]).
This is very useful for ...
- 490
1
vote
Webform Email Does Not Pass DMARC
I'm the author of an open source contact form that can be used on websites. Here is what I do to allow my webservers to send email to my domain and pass all spam checks:
Contact form configuration:
...
- 99.2k
1
vote
Do subdomains inherit DKIM keys? Can a DKIM SDID for one domain be used to validly sign mail that appears to be sent from another domain?
From rfc-editor
3.10. Signing by Parent Domains
In some circumstances, it is desirable for a domain to apply a
signature on behalf of any of its subdomains without the need to
maintain separate ...
- 11
1
vote
Accepted
Do subdomains inherit DKIM keys? Can a DKIM SDID for one domain be used to validly sign mail that appears to be sent from another domain?
Re the first question: As mentioned in Patrick's answer, there is no inheritance.
Re the second question: I've now realised that DKIM doesn't specify which SDIDs are permitted for particular email ...
- 189
1
vote
DMARC report: systematic SPF failure for a domain
bounce.domain.co.uk should have an SPF record in order to pass authentication check
and header from domain should be equal or aligned with bounce.domain.co.uk in order to pass DMARC check
- 21
1
vote
BIMI Validation failure
SVG contains disallowed references
You can download on Agari's own BIMI logo, check file content and make sure that your one also looks similar ->
https://def0a2r1nm3zw.cloudfront.net/...
- 21
Only top scored, non community-wiki answers of a minimum length are eligible