It's just been 4 days. I think I might reach out to the partner team

Iia It's just been 4 days. I think I might reach out to the partner team

Peps•3/24/25, 2:03 PM

Yeah billing response times are a bit high at the moment. If you happen to have a CSM, and the billing issue is causing you issues, then I definitely recommend contacting them as well

BenAgu•3/24/25, 3:53 PM

Hello,
Since November, I have subscribed to and paid for a pro subscription (it was a renewal) for one of my websites. I also had a second subscription for another website, but I canceled that one.

Since I did this, the subscription for my first site is no longer active, even though I paid for it.

As I’m now stuck with a free plan, I’m unable to contact support to resolve this issue and reactivate my access.

Can someone help me? I have the invoice as proof.

Thank you in advance.

BBenAgu Hello, Since November, I have subscribed to and paid for a pro subscription (it ...

Peps•3/24/25, 3:54 PM

?billing

SuperHelpflare•3/24/25, 3:54 PM

Cloudflare's billing system is undergoing some changes/migration. During this period, you may notice extra bills, incorrect bills, or other issues.

To resolve these issues, create a Support ticket by using the following link (you must be logged into your Cloudflare account): https://dash.cloudflare.com/?to=/:account/support

Note that all accounts, even Free plan accounts, can create billing tickets. Tickets are the only way to resolve billing issues; we cannot help you in this Discord.

Peps•3/24/25, 3:54 PM

you can contact billing support by following the instructions above

WTDawson9•3/24/25, 5:45 PM

I've noticed that I always get a DMARC fail from 20i Limited, trying to spoof their address as my domain, like I've never seen it disappear from the dashboard

WTDawson9•3/24/25, 5:45 PM

I looked them up and they're a hosting company, do you think it's a good idea to see if I can contact them about it?

WWTDawson9 I've noticed that I always get a DMARC fail from 20i Limited, trying to spoof th...

DarkDeviL•3/24/25, 6:12 PM

Is it (always(?)) failing both DKIM and SPF?
Is there any domain name(s) you can share?
Is your domain name like a well-known phrase, or word?
Is your domain name similar to any theirs, such as e.g. where a simple typo would explain it?
E.g. cloudFLAREcloudFLARE vs. cloudFAREcloudFARE, gooGLEgooGLE vs gooGELgooGEL?

DDarkDeviL 1. Is it (always(?)) failing both DKIM and SPF? 2. Is there any domain name(s) y...

WTDawson9•3/24/25, 7:01 PM

Always fails both (I can provide a screenshot if you'd like, but I'll remove the IP)
It's attempting to spoof the domain as wtdawson.info
Nope
Nope, theirs is 20i.com, mine is wtdawson.info

WTDawson9•3/24/25, 7:02 PM

It's only once in the last 7 days, but I have seen them in the past attempting to spoof their domain as mine

WTDawson9•3/24/25, 7:05 PM

This one is fine, since both of the domains are mine, I'm also just confused as to why this happened since nothing has the capability to send email from bananasoftware.dev

WWTDawson9 1. Always fails both (I can provide a screenshot if you'd like, but I'll remove ...

DarkDeviL•3/24/25, 7:09 PM

wtdawson.infowtdawson.info has a MX that points to mx.stackmail.commx.stackmail.com, and mx.stackmail.commx.stackmail.com points to 185.151.28.67185.151.28.67.

A whois for 185.151.28.67185.151.28.67 gives indications of "20i Ltd20i Ltd".

DDarkDeviL `wtdawson.info` has a MX that points to `mx.stackmail.com`, and `mx.stackmail.co...

WTDawson9•3/24/25, 7:09 PM

I use Stackmail, but I swear that's run by UK2

WTDawson9•3/24/25, 7:10 PM

Oh hold up

WTDawson9•3/24/25, 7:10 PM

That makes sense

WTDawson9•3/24/25, 7:10 PM

WTDawson9•3/24/25, 7:10 PM

But also doesn't make sense

WTDawson9•3/24/25, 7:11 PM

I guess I never checked when they moved my emails to Stackmail

WTDawson9•3/24/25, 7:11 PM

Alright my bad

DarkDeviL•3/24/25, 7:13 PM

I would suspect that you sent an email, that ended up on crossing over Stackmail, and from there, it was then forwarded to Google / Outlook respectively.

WTDawson9•3/24/25, 7:17 PM

Ah, so does that mean if someone forwards one of my emails then it may get rejected because of my DMARC records?

DarkDeviL•3/24/25, 7:17 PM

Anyway, as always, I would advice you to:

Verify that all your (valid, legitimate, ...) outbound email streams are properly DKIM signed.
When #1 is done and successful, switch the DMARC policies for your domains to "p=reject; sp=reject; np=reject;p=reject; sp=reject; np=reject;"

After both are successful, receiving infrastructures that validate DMARC (and act properly on them), will then reject messages that neither conform to the DKIM alignment nor SPF alignment, when it ended up on their infrastructure.

WWTDawson9 Ah, so does that mean if someone forwards one of my emails then it may get rejec...

DarkDeviL•3/24/25, 7:18 PM

As your current policy seems to be "nonenone", no action will be taken at the moment.

WTDawson9•3/24/25, 7:19 PM

So like v=DMARC1; p=none; rua=*@dmarc-reports.cloudflare.net; p=reject; sp=reject; np=reject;v=DMARC1; p=none; rua=*@dmarc-reports.cloudflare.net; p=reject; sp=reject; np=reject; (Keeping the parts that are already there)

DarkDeviL•3/24/25, 7:19 PM

Your SPF is broken on that .info.info domain though, likely due to copy-pasting in control characters.

It currently ends with " a mx \226\128\147all a mx \226\128\147all".

WTDawson9•3/24/25, 7:21 PM

Looks fine to me

WWTDawson9 So like `v=DMARC1; p=none; rua=*@dmarc-reports.cloudflare.net; p=reject; sp=reje...

DarkDeviL•3/24/25, 7:23 PM

You would replace the existing "p=nonep=none", instead of having two (or more) duplicated fields.

But as I mentioned above, verify #1 first, for your existing and legitimate email flows.

WWTDawson9 Looks fine to me

Isaac McFadyen•3/24/25, 7:24 PM

I also see the control characters, it's probably not showing them on that specific DNS lookup interface (perhaps because it's being rendered in the HTML as some invisible unicode chars).

DDarkDeviL You would replace the existing "`p=none`", instead of having two (or more) dupli...

WTDawson9•3/24/25, 7:24 PM

I believe that Stackmail is DKIM signed

Isaac McFadyen•3/24/25, 7:25 PM

Oh actually you have an emdash instead of a dash in front of allall

WWTDawson9 Looks fine to me

DarkDeviL•3/24/25, 7:25 PM

(I would probably go as far as to ignore everything that MxToolbox is shouting in your direction.

)

Isaac McFadyen•3/24/25, 7:25 PM

—all—all (emdash) versus -all-all (correct)

WTDawson9•3/24/25, 7:26 PM

Ah right, Stackmail clearly isn't DKIM signed (My test email got rejected)

WWTDawson9 I believe that Stackmail is DKIM signed

DarkDeviL•3/24/25, 7:26 PM

If your legitimate flows are failing, they will be rejected too.

And assuming that the DMARC reports above were legitimate mails from you, that crossed through them, you would then fail.

WTDawson9•3/24/25, 7:27 PM

I'll send some more emails and see if the number goes up

WTDawson9•3/24/25, 7:27 PM

Two secs

WTDawson9•3/24/25, 7:28 PM

Idk how often it updates tbf

DarkDeviL•3/24/25, 7:28 PM

It may take a (long) while, ... DMARC aggregate reports are generally sent once per 24 hours at most.

WTDawson9•3/24/25, 7:29 PM

Alright

WTDawson9•3/24/25, 7:29 PM

Well, I will come back to this tomorrow

WTDawson9•3/24/25, 7:33 PM

Oh and also, if I try to enable this, it just never does anything
It appears like the API route that ends with bot_managementbot_management just doesn't respond

WTDawson9•3/24/25, 7:34 PM

Irma•3/24/25, 7:37 PM

Hello, my name is Irma and I have questions about 5 warnings that appeared during DNS health check:DNS DMARC RUA / RUF domains Not valid. Reverse DNS does not match SMTP Banner. SOA Expire Value is out of recommended range. SOA Serial Number Format is Invalid. Also, email for RUA was not mine. How this can be fixed? Thank you in advance!

Core•3/25/25, 7:41 AM

@Dane

It's just been 4 days. I think I might reach out to the partner team

Similar Threads

Similar Threads

Similar Threads