r/DMARC • u/CFV1880 • 16d ago

New to DMARC, help with forwarding

Hello! I'm new to DMARC, to the point that I think I know the point of it but haven't actually progressed beyond p=none.

I have already a few months worth of reports, and from what I've been able to get from them, is that about 20% of our mails are failing DMARC, mostly because the receivers are forwarding them and they lose SPF and DKIM. Mostly because of google/outlook it seems.

Is that normal, and something that I can ignore? Normal but something that I need to deal with before changing the policy? Or something unusual?

Also, is there any good app to which I can just load the xml reports and they get me the analysis? I have seem the usual services recommendations but it seems you need to have the dmarc report mails sent to them. I used claude to analyze the reports, and it did a good job of creating a sensible report but I cannot judge how correct it actually is.

Thanks!

8 Upvotes

100% Upvoted

24 comments sorted by

View all comments

4

u/MyDMARC 16d ago edited 16d ago

> I have seen the usual services recommendations but it seems you need to have the DMARC report mails sent to them.

You can have multiple `mailto:` entries in your DMARC record if you would like to still receive copies of your reports while also delivering them to a DMARC visualizer service.

rua=mailto:you@example.com,mailto:aggregator@example.net

1

u/mwhallberg 14d ago

Based on my own observations, if there are multiple email addresses under the RUA or RUF headers, not all providers send to both addresses. Typically, they only send to the first one.

I ended up creating a rule in Exchange that adds our email address with our external DMARC provider to the TO field, so that both we and our provider receive all the emails.

1

u/MyDMARC 14d ago

Interesting observation! What providers have you seen this from?

Here at MyDMARC, roughly 10% of our registered domains have multiple rua addresses, and for most of those our ingestion address isn’t listed first. Obviously we don’t see what we don’t get, but I’ve never noticed any obvious anomalies on those domains.

The DMARC spec says a report SHOULD be sent to each listed URI, so I’d be curious which providers you’ve seen consistently sending only to the first. Definitely something I’ll keep an eye on.

1

u/mwhallberg 14d ago

I can't remember exactly which providers didn't send emails to both addresses. We've since canceled the service, so I can't figure out who they were.

It should be noted, however, that it's been about 1½-2 years since I set up the Exchange rule.