Cloudflare Developers•10mo ago

1. Is it (always(?)) failing both DKIM and SPF? 2. Is there any domain name(s) you can share? 3. Is

Is it (always(?)) failing both DKIM and SPF?
Is there any domain name(s) you can share?
Is your domain name like a well-known phrase, or word?
Is your domain name similar to any theirs, such as e.g. where a simple typo would explain it?
E.g.
```
cloudFLARE
```
cloudFLARE
```
cloudFLARE
```
cloudFLARE
vs.
```
cloudFARE
```
cloudFARE
```
cloudFARE
```
cloudFARE
,
```
gooGLE
```
gooGLE
```
gooGLE
```
gooGLE
vs
```
gooGEL
```
gooGEL
```
gooGEL
```
gooGEL
?

DDarkDeviL 1. Is it (always(?)) failing both DKIM and SPF? 2. Is there any domain name(s) y...

WTDawson9•3/24/25, 7:01 PM

Always fails both (I can provide a screenshot if you'd like, but I'll remove the IP)
It's attempting to spoof the domain as wtdawson.info
Nope
Nope, theirs is 20i.com, mine is wtdawson.info

WTDawson9•3/24/25, 7:02 PM

It's only once in the last 7 days, but I have seen them in the past attempting to spoof their domain as mine

WTDawson9•3/24/25, 7:05 PM

This one is fine, since both of the domains are mine, I'm also just confused as to why this happened since nothing has the capability to send email from bananasoftware.dev

WWTDawson9 1. Always fails both (I can provide a screenshot if you'd like, but I'll remove ...

DarkDeviLOP•3/24/25, 7:09 PM

wtdawson.info

wtdawson.info

has a MX that points to

mx.stackmail.com

mx.stackmail.com

, and

mx.stackmail.com

mx.stackmail.com

points to

185.151.28.67

185.151.28.67

.

A whois for

185.151.28.67

185.151.28.67

gives indications of "

20i Ltd

20i Ltd

DDarkDeviL `wtdawson.info` has a MX that points to `mx.stackmail.com`, and `mx.stackmail.co...

WTDawson9•3/24/25, 7:09 PM

I use Stackmail, but I swear that's run by UK2

WTDawson9•3/24/25, 7:10 PM

Oh hold up

WTDawson9•3/24/25, 7:10 PM

That makes sense

WTDawson9•3/24/25, 7:10 PM

WTDawson9•3/24/25, 7:10 PM

But also doesn't make sense

WTDawson9•3/24/25, 7:11 PM

I guess I never checked when they moved my emails to Stackmail

WTDawson9•3/24/25, 7:11 PM

Alright my bad

DarkDeviLOP•3/24/25, 7:13 PM

I would suspect that you sent an email, that ended up on crossing over Stackmail, and from there, it was then forwarded to Google / Outlook respectively.

WTDawson9•3/24/25, 7:17 PM

Ah, so does that mean if someone forwards one of my emails then it may get rejected because of my DMARC records?

DarkDeviLOP•3/24/25, 7:17 PM

Anyway, as always, I would advice you to:

Verify that all your (valid, legitimate, ...) outbound email streams are properly DKIM signed.
When #1 is done and successful, switch the DMARC policies for your domains to "
```
p=reject; sp=reject; np=reject;
```
```
p=reject; sp=reject; np=reject;
```
"

After both are successful, receiving infrastructures that validate DMARC (and act properly on them), will then reject messages that neither conform to the DKIM alignment nor SPF alignment, when it ended up on their infrastructure.

WWTDawson9 Ah, so does that mean if someone forwards one of my emails then it may get rejec...

DarkDeviLOP•3/24/25, 7:18 PM

As your current policy seems to be "

none

none

", no action will be taken at the moment.

WTDawson9•3/24/25, 7:19 PM

So like

v=DMARC1; p=none; rua=*@dmarc-reports.cloudflare.net; p=reject; sp=reject; np=reject;

v=DMARC1; p=none; rua=*@dmarc-reports.cloudflare.net; p=reject; sp=reject; np=reject;

(Keeping the parts that are already there)

DarkDeviLOP•3/24/25, 7:19 PM

Your SPF is broken on that

.info

.info

domain though, likely due to copy-pasting in control characters.

It currently ends with "

 a mx \226\128\147all

 a mx \226\128\147all

WTDawson9•3/24/25, 7:21 PM

Looks fine to me

WWTDawson9 So like `v=DMARC1; p=none; rua=*@dmarc-reports.cloudflare.net; p=reject; sp=reje...

DarkDeviLOP•3/24/25, 7:23 PM

You would replace the existing "

p=none

p=none

", instead of having two (or more) duplicated fields.

But as I mentioned above, verify #1 first, for your existing and legitimate email flows.

WWTDawson9 Looks fine to me

Isaac McFadyen•3/24/25, 7:24 PM

I also see the control characters, it's probably not showing them on that specific DNS lookup interface (perhaps because it's being rendered in the HTML as some invisible unicode chars).

DDarkDeviL You would replace the existing "`p=none`", instead of having two (or more) dupli...

WTDawson9•3/24/25, 7:24 PM

I believe that Stackmail is DKIM signed

Isaac McFadyen•3/24/25, 7:25 PM

Oh actually you have an emdash instead of a dash in front of

all

all

WWTDawson9 Looks fine to me

DarkDeviLOP•3/24/25, 7:25 PM

(I would probably go as far as to ignore everything that MxToolbox is shouting in your direction.

)

Isaac McFadyen•3/24/25, 7:25 PM

—all

—all

(emdash) versus

-all

-all

(correct)

WTDawson9•3/24/25, 7:26 PM

Ah right, Stackmail clearly isn't DKIM signed (My test email got rejected)

WWTDawson9 I believe that Stackmail is DKIM signed

DarkDeviLOP•3/24/25, 7:26 PM

If your legitimate flows are failing, they will be rejected too.

And assuming that the DMARC reports above were legitimate mails from you, that crossed through them, you would then fail.

WTDawson9•3/24/25, 7:27 PM

I'll send some more emails and see if the number goes up

WTDawson9•3/24/25, 7:27 PM

Two secs

WTDawson9•3/24/25, 7:28 PM

Idk how often it updates tbf

DarkDeviLOP•3/24/25, 7:28 PM

It may take a (long) while, ... DMARC aggregate reports are generally sent once per 24 hours at most.

WTDawson9•3/24/25, 7:29 PM

Alright

WTDawson9•3/24/25, 7:29 PM

Well, I will come back to this tomorrow

WTDawson9•3/24/25, 7:33 PM

Oh and also, if I try to enable this, it just never does anything
It appears like the API route that ends with

bot_management

bot_management

just doesn't respond

WTDawson9•3/24/25, 7:34 PM

Irma•3/24/25, 7:37 PM

Hello, my name is Irma and I have questions about 5 warnings that appeared during DNS health check:DNS DMARC RUA / RUF domains Not valid. Reverse DNS does not match SMTP Banner. SOA Expire Value is out of recommended range. SOA Serial Number Format is Invalid. Also, email for RUA was not mine. How this can be fixed? Thank you in advance!