0

I keep getting DMARC reports that show that my IP passed all SPF and DKIM checks. Is this just an email to say that everything's fine or is it an indication of a problem? If the latter, there's nothing in that email that would help figure out what the issue is.

Here's a sample email (domain and IP changed):

<?xml version="1.0" encoding="UTF-8" ?>
<feedback>
<version>1.0</version>
<report_metadata>
    <org_name>recipient.com</org_name>
    <email>DMARC_REPORT@recipient.com</email>
    <extra_contact_info>SSC-ICT</extra_contact_info>
    <report_id>e0c90e$729c87e=29c6e2f826d23115@recipient.com</report_id>
    <date_range>
        <begin>1456182003</begin>
        <end>1456268403</end>
    </date_range>
</report_metadata>
<policy_published>
    <domain>mydomain.com</domain>
    <adkim>r</adkim>
    <aspf>r</aspf>
    <p>none</p>
    <sp>none</sp>
    <pct>100</pct>
</policy_published>
<record>
    <row>
        <source_ip>1.2.3.4</source_ip>
        <count>6</count>
        <policy_evaluated>
            <disposition>none</disposition>
            <dkim>pass</dkim>
            <spf>pass</spf>
        </policy_evaluated>
    </row>
    <identifiers>
        <header_from>mydomain.com</header_from>
        <envelope_from>mydomain.com</envelope_from>
    </identifiers>
    <auth_results>
        <dkim>
            <domain>mydomain.com</domain>
            <selector>mail</selector>
            <result>pass</result>
        </dkim>
        <spf>
            <domain>mydomain.com</domain>
            <scope>mfrom</scope>
            <result>pass</result>
       </spf>
    </auth_results>
</record>
</feedback>
mwoods
  • 3
  • 2
  • Did you ask for a report? You forgot to share your DMARC record (or your domain name). – Michael Hampton Feb 24 '16 at 00:18
  • It's v=DMARC1; p=none; sp=none; rua=mailto:me@mydomain.com; ruf=me@mydomain.com; rf=afrf; pct=100; ri=86400 Perhaps I misunderstood how DMARC works. I'd like to receive alerts only in the event of a failure. – mwoods Feb 24 '16 at 00:46

1 Answers1

1
  • This is aggregated report which tells overall statistics.
  • I think you are referring to Forensics report. When DMARC validation failed, it will send the copy of message in AFRF format to "ruf=me@mydomain.com; "
Syed Alam
  • 71
  • 5