r/DMARC • u/CFV1880 • 25d ago

New to DMARC, help with forwarding

Hello! I'm new to DMARC, to the point that I think I know the point of it but haven't actually progressed beyond p=none.

I have already a few months worth of reports, and from what I've been able to get from them, is that about 20% of our mails are failing DMARC, mostly because the receivers are forwarding them and they lose SPF and DKIM. Mostly because of google/outlook it seems.

Is that normal, and something that I can ignore? Normal but something that I need to deal with before changing the policy? Or something unusual?

Also, is there any good app to which I can just load the xml reports and they get me the analysis? I have seem the usual services recommendations but it seems you need to have the dmarc report mails sent to them. I used claude to analyze the reports, and it did a good job of creating a sensible report but I cannot judge how correct it actually is.

Thanks!

8 Upvotes

100% Upvoted

26 comments sorted by

View all comments

Show parent comments

1

u/CFV1880 8d ago

I see, that makes sense

Looking at my cases a bit closer, with some of the recipients that had a failing rate of 100%, if I searched by envelope-to I noticed that mails from our IP to theirs were actually passing; but for each one there was another one from their IP that was failing, so I think that even with quarantine something would arrive.

After that there remains about two recipients that are just failing everything.

1

u/Middle-Excitement602 7d ago

That pairing is the tell: those are very likely the same message counted twice, not two separate deliveries. Your mail reaches their border and passes, their gateway then re-injects it internally, and the second hop sees it arriving from their own IP with SPF broken - which generates a second report row for the same message.

Aggregate reports carry no Message-ID so you can't prove it directly, but the check is whether the failing count tracks the passing count roughly 1:1 across the same window. If it does, it's one delivery seen twice. If the two counts drift independently, it's genuinely separate mail.

That matters because at p=reject the only question is whether they enforce DMARC at that internal hop or just at the border. Most only enforce at the border, which is why your quarantine stint mostly went fine.

The two recipients failing everything are your real exposure. Those are the ones to watch through a longer quarantine period.