0

I've recently set up DMARC, SPF and DKIM. I'm now checking all DMARC reports I'm receiving. I've noticed the below entry which looks like an IP which is outside my control (the other IPs mentioned I see daily and are the ISP SMTP). So this one entry seems to be off. Now I wonder what I should conclude with this. Is this an email server, which successfully auths (using SPF and DKIM, so I can be "assured" it's actually the mailserver it claims to be) sending an email out in the name of mydomain.com? Note that mydomain.com is doing business with otherdomain.com. So perhaps I'm reading this incorrectly. However I don't see any incoming email for mydomain.com from them yesterday so this must have been a mail addressed to another domain.

I don't see any reason why this company would be needing to send emails in name of my domain. I know I change the policy using DMARC to drop such emails but nonetheless it seems interesting to investigate what's going on here.

<record>
  <row>
    <source_ip>w.x.y.z</source_ip>
    <count>4</count>
    <policy_evaluated>
      <disposition>none</disposition>
      <dkim>fail</dkim>
      <spf>fail</spf>
    </policy_evaluated>
  </row>
  <identifiers>
    <header_from>mydomain.com</header_from>
  </identifiers>
  <auth_results>
    <dkim>
      <domain>otherdomain-com.20150623.gappssmtp.com</domain>
      <result>pass</result>
      <selector>20150623</selector>
    </dkim>
    <spf>
      <domain>otherdomain.com</domain>
      <result>pass</result>
    </spf>
  </auth_results>
</record>

Thansk a lot in advance.

Esa Jokinen
  • 43,252
  • 2
  • 75
  • 122
th3penguinwhisperer
  • 53
  • 8

1 Answers1

0

If the IP you've hidden is Google IP and the domain you've hidden sends email to Gmail or Google Apps, this likely normal internal forwarding traffic. Google is fairly noisy in how they report this traffic.

cmeid
  • 386
  • 1
  • 3
  • Thanks for your response. The hidden source_ip is from otherdomain.com. Does the same apply in that case? otherdomain.com is a third party which mydomain.com is doing business with. – th3penguinwhisperer Jul 13 '17 at 10:49
  • Yeah - any time you see that gappssmtp.com you're dealing with a google forward. The other domain most likely forwarded it into Gmail/Google Apps. – cmeid Jul 14 '17 at 06:51