I've noticed that I always get a DMARC fail from 20i Limited, trying to spoof their address as my do

I've noticed that I always get a DMARC fail from 20i Limited, trying to spoof their address as my domain, like I've never seen it disappear from the dashboard

WTDawson9OP•3/24/25, 5:45 PM

I looked them up and they're a hosting company, do you think it's a good idea to see if I can contact them about it?

WWTDawson9 I've noticed that I always get a DMARC fail from 20i Limited, trying to spoof th...

DarkDeviL•3/24/25, 6:12 PM

Is it (always(?)) failing both DKIM and SPF?
Is there any domain name(s) you can share?
Is your domain name like a well-known phrase, or word?
Is your domain name similar to any theirs, such as e.g. where a simple typo would explain it?
E.g.
```
cloudFLARE
```
```
cloudFLARE
```
vs.
```
cloudFARE
```
```
cloudFARE
```
,
```
gooGLE
```
```
gooGLE
```
vs
```
gooGEL
```
```
gooGEL
```
?

DDarkDeviL 1. Is it (always(?)) failing both DKIM and SPF? 2. Is there any domain name(s) y...

WTDawson9OP•3/24/25, 7:01 PM

Always fails both (I can provide a screenshot if you'd like, but I'll remove the IP)
It's attempting to spoof the domain as wtdawson.info
Nope
Nope, theirs is 20i.com, mine is wtdawson.info

WTDawson9OP•3/24/25, 7:02 PM

It's only once in the last 7 days, but I have seen them in the past attempting to spoof their domain as mine

WTDawson9OP•3/24/25, 7:05 PM

This one is fine, since both of the domains are mine, I'm also just confused as to why this happened since nothing has the capability to send email from bananasoftware.dev

WWTDawson9 1. Always fails both (I can provide a screenshot if you'd like, but I'll remove ...

DarkDeviL•3/24/25, 7:09 PM

wtdawson.info

wtdawson.info

has a MX that points to

mx.stackmail.com

mx.stackmail.com

, and

mx.stackmail.com

mx.stackmail.com

points to

185.151.28.67

185.151.28.67

.

A whois for

185.151.28.67

185.151.28.67

gives indications of "

20i Ltd

20i Ltd

DDarkDeviL `wtdawson.info` has a MX that points to `mx.stackmail.com`, and `mx.stackmail.co...

WTDawson9OP•3/24/25, 7:09 PM

I use Stackmail, but I swear that's run by UK2

WTDawson9OP•3/24/25, 7:10 PM

Oh hold up

WTDawson9OP•3/24/25, 7:10 PM

That makes sense

WTDawson9OP•3/24/25, 7:10 PM

WTDawson9OP•3/24/25, 7:10 PM

But also doesn't make sense

WTDawson9OP•3/24/25, 7:11 PM

I guess I never checked when they moved my emails to Stackmail

WTDawson9OP•3/24/25, 7:11 PM

Alright my bad

DarkDeviL•3/24/25, 7:13 PM

I would suspect that you sent an email, that ended up on crossing over Stackmail, and from there, it was then forwarded to Google / Outlook respectively.

WTDawson9OP•3/24/25, 7:17 PM

Ah, so does that mean if someone forwards one of my emails then it may get rejected because of my DMARC records?

DarkDeviL•3/24/25, 7:17 PM

Anyway, as always, I would advice you to:

Verify that all your (valid, legitimate, ...) outbound email streams are properly DKIM signed.
When #1 is done and successful, switch the DMARC policies for your domains to "
```
p=reject; sp=reject; np=reject;
```
```
p=reject; sp=reject; np=reject;
```
"

After both are successful, receiving infrastructures that validate DMARC (and act properly on them), will then reject messages that neither conform to the DKIM alignment nor SPF alignment, when it ended up on their infrastructure.

WWTDawson9 Ah, so does that mean if someone forwards one of my emails then it may get rejec...

DarkDeviL•3/24/25, 7:18 PM

As your current policy seems to be "nonenone", no action will be taken at the moment.

WTDawson9OP•3/24/25, 7:19 PM

So like v=DMARC1; p=none; rua=*@dmarc-reports.cloudflare.net; p=reject; sp=reject; np=reject;v=DMARC1; p=none; rua=*@dmarc-reports.cloudflare.net; p=reject; sp=reject; np=reject; (Keeping the parts that are already there)

DarkDeviL•3/24/25, 7:19 PM

Your SPF is broken on that .info.info domain though, likely due to copy-pasting in control characters.

It currently ends with " a mx \226\128\147all a mx \226\128\147all".

WTDawson9OP•3/24/25, 7:21 PM

Looks fine to me

WWTDawson9 So like `v=DMARC1; p=none; rua=*@dmarc-reports.cloudflare.net; p=reject; sp=reje...

DarkDeviL•3/24/25, 7:23 PM

You would replace the existing "

p=none

p=none

", instead of having two (or more) duplicated fields.

But as I mentioned above, verify #1 first, for your existing and legitimate email flows.

WWTDawson9 Looks fine to me

Isaac McFadyen•3/24/25, 7:24 PM

I also see the control characters, it's probably not showing them on that specific DNS lookup interface (perhaps because it's being rendered in the HTML as some invisible unicode chars).

DDarkDeviL You would replace the existing "`p=none`", instead of having two (or more) dupli...

WTDawson9OP•3/24/25, 7:24 PM

I believe that Stackmail is DKIM signed

Isaac McFadyen•3/24/25, 7:25 PM

Oh actually you have an emdash instead of a dash in front of allall

WWTDawson9 Looks fine to me

DarkDeviL•3/24/25, 7:25 PM

(I would probably go as far as to ignore everything that MxToolbox is shouting in your direction.

)

Isaac McFadyen•3/24/25, 7:25 PM

—all—all (emdash) versus -all-all (correct)

WTDawson9OP•3/24/25, 7:26 PM

Ah right, Stackmail clearly isn't DKIM signed (My test email got rejected)

WWTDawson9 I believe that Stackmail is DKIM signed

DarkDeviL•3/24/25, 7:26 PM

If your legitimate flows are failing, they will be rejected too.

And assuming that the DMARC reports above were legitimate mails from you, that crossed through them, you would then fail.

WTDawson9OP•3/24/25, 7:27 PM

I'll send some more emails and see if the number goes up

WTDawson9OP•3/24/25, 7:27 PM

Two secs

WTDawson9OP•3/24/25, 7:28 PM

Idk how often it updates tbf

DarkDeviL•3/24/25, 7:28 PM

It may take a (long) while, ... DMARC aggregate reports are generally sent once per 24 hours at most.

WTDawson9OP•3/24/25, 7:29 PM

Alright

WTDawson9OP•3/24/25, 7:29 PM

Well, I will come back to this tomorrow

WTDawson9OP•3/24/25, 7:33 PM

Oh and also, if I try to enable this, it just never does anything
It appears like the API route that ends with bot_managementbot_management just doesn't respond

WTDawson9OP•3/24/25, 7:34 PM

Irma•3/24/25, 7:37 PM

Hello, my name is Irma and I have questions about 5 warnings that appeared during DNS health check:DNS DMARC RUA / RUF domains Not valid. Reverse DNS does not match SMTP Banner. SOA Expire Value is out of recommended range. SOA Serial Number Format is Invalid. Also, email for RUA was not mine. How this can be fixed? Thank you in advance!