: DMARC -- understanding aggregate reports TL;DR I get a lot of DMARC feedback from accounts/websites I don't have contact with and want some clarity on if I should be taking any action

@Nimeshi995

Posted in: #Email

TL;DR
I get a lot of DMARC feedback from accounts/websites I don't have contact with and want some clarity on if I should be taking any action or if these feedback reports are informative of any serious issues?


I run a WHM server and use SPF and DKIM (and _DMARC), all emails are sent from the same domain server.

An example DNS setup for my _DMARC (and DKIM and SPF):

mydomain.co.uk 14400 IN TXT "v=spf1 mx a ip4:11.22.33.44 ip4:11.22.33.55 ~all"

default._domainkey 14400 IN TXT "v=DKIM1; k=rsa; p=<code>;

_dmarc 14400 IN TXT "v=DMARC1; p=quarantine; sp=none;
rua=mailto:me@mydomain.co.uk!90m;
ruf=mailto:me@mydomain.co.uk;
rf=afrf; pct=100; ri=86400"


and as far as I can tell this is set up and works as expected.

however, I get quite a few automatic messages from various domains across the world wide web, which have nothing to do with my domain. I am the only person using emails from my domain, no one else is emailing from my domain.

For example, this morning I received a DMARC aggregate report from Comcast stating:

<?xml version="1.0" encoding="UTF-8" ?>
<feedback>
<version>1.0</version>
<report_metadata>
<org_name>comcast.net</org_name>
<email>dmarc-admin@alerts.comcast.net</email>
<report_id>v1-1483425166-mydomain.co.uk</report_id>
<date_range>
<begin>1483315200</begin>
<end>1483401600</end>
</date_range>
</report_metadata>
<policy_published>
<domain>mydomain.co.uk</domain>
<adkim>r</adkim>
<aspf>r</aspf>
<p>quarantine</p>
<sp>none</sp>
<pct>100</pct>
<fo>0</fo>
</policy_published>
<record>
<row>
<source_ip>72.167.218.164</source_ip>
<count>1</count>
<policy_evaluated>
<disposition>none</disposition>
<dkim>fail</dkim>
<spf>fail</spf>
</policy_evaluated>
</row>
<identifiers>
<header_from>mydomain.co.uk</header_from>
</identifiers>
<auth_results>
<spf>
<domain>bounce.secureserver.net</domain>
<scope>mfrom</scope>
<result>pass</result>
</spf>
</auth_results>
</record>
</feedback>


No I don't recognise any of the details set out here aside from my domain, the IP address give in <source_ip> is not my IP address and I am unaware of having any contact at all with Comcast.

Basically, I get quite a lot of these notices and I can't find any feedback as to tell me if they're just informative and can be forgotten about (in which case what's the point of them?) or if I can do something with my server to improve the failings that the notice informs me of.

SO:


Are these reports something that can be acted upon?
How Should DMARC reports such as these be acted upon at my end?
Are these reports indicators of any form of account compromise
can/does the number of these reports [potentially] reflect badly upon my domain name to the rest of the 'web?


It may be worth noting I suspect the answer to the last two bullets to both be "No", But I'm not an expert on these.



I have already read this post as well as the DMARC FAQ and this topic, but there's not much info. on how we're meant to react to aggregate reports. I am aware that "failed" DMARC reports can be caused by mail forwarding programs, although I hope to negate this possibility with my SPF ~all.

Overall I think I shouldn't need to worry about these reports but I would like a second opinion due to what I perceive as the regularity and (I think) relatively significant number of aggregate reports I'm receiving.

Vote Up Vote Down

Login to post a comment!