`wtdawson.info` has a MX that points to `mx.stackmail.com`, and `mx.stackmail.com` points to `185.15

wtdawson.info

wtdawson.info

wtdawson.info

wtdawson.info has a MX that points to

mx.stackmail.com

mx.stackmail.com

mx.stackmail.com

mx.stackmail.com, and

mx.stackmail.com

mx.stackmail.com

mx.stackmail.com

mx.stackmail.com points to

185.151.28.67

185.151.28.67

185.151.28.67

185.151.28.67.

A whois for

185.151.28.67

185.151.28.67

185.151.28.67

185.151.28.67 gives indications of "

20i Ltd

20i Ltd

20i Ltd

20i Ltd".

DDarkDeviL `wtdawson.info` has a MX that points to `mx.stackmail.com`, and `mx.stackmail.co...

WTDawson9•3/24/25, 7:09 PM

I use Stackmail, but I swear that's run by UK2

WTDawson9•3/24/25, 7:10 PM

Oh hold up

WTDawson9•3/24/25, 7:10 PM

That makes sense

WTDawson9•3/24/25, 7:10 PM

WTDawson9•3/24/25, 7:10 PM

But also doesn't make sense

WTDawson9•3/24/25, 7:11 PM

I guess I never checked when they moved my emails to Stackmail

WTDawson9•3/24/25, 7:11 PM

Alright my bad

DarkDeviLOP•3/24/25, 7:13 PM

I would suspect that you sent an email, that ended up on crossing over Stackmail, and from there, it was then forwarded to Google / Outlook respectively.

WTDawson9•3/24/25, 7:17 PM

Ah, so does that mean if someone forwards one of my emails then it may get rejected because of my DMARC records?

DarkDeviLOP•3/24/25, 7:17 PM

Anyway, as always, I would advice you to:

Verify that all your (valid, legitimate, ...) outbound email streams are properly DKIM signed.
When #1 is done and successful, switch the DMARC policies for your domains to "p=reject; sp=reject; np=reject;p=reject; sp=reject; np=reject;"

After both are successful, receiving infrastructures that validate DMARC (and act properly on them), will then reject messages that neither conform to the DKIM alignment nor SPF alignment, when it ended up on their infrastructure.

WWTDawson9 Ah, so does that mean if someone forwards one of my emails then it may get rejec...

DarkDeviLOP•3/24/25, 7:18 PM

As your current policy seems to be "

none

none

", no action will be taken at the moment.

WTDawson9•3/24/25, 7:19 PM

So like v=DMARC1; p=none; rua=*@dmarc-reports.cloudflare.net; p=reject; sp=reject; np=reject;v=DMARC1; p=none; rua=*@dmarc-reports.cloudflare.net; p=reject; sp=reject; np=reject; (Keeping the parts that are already there)

DarkDeviLOP•3/24/25, 7:19 PM

Your SPF is broken on that .info.info domain though, likely due to copy-pasting in control characters.

It currently ends with " a mx \226\128\147all a mx \226\128\147all".

WTDawson9•3/24/25, 7:21 PM

Looks fine to me

WWTDawson9 So like `v=DMARC1; p=none; rua=*@dmarc-reports.cloudflare.net; p=reject; sp=reje...

DarkDeviLOP•3/24/25, 7:23 PM

You would replace the existing "p=nonep=none", instead of having two (or more) duplicated fields.

But as I mentioned above, verify #1 first, for your existing and legitimate email flows.

WWTDawson9 Looks fine to me

Isaac McFadyen•3/24/25, 7:24 PM

I also see the control characters, it's probably not showing them on that specific DNS lookup interface (perhaps because it's being rendered in the HTML as some invisible unicode chars).

DDarkDeviL You would replace the existing "`p=none`", instead of having two (or more) dupli...

WTDawson9•3/24/25, 7:24 PM

I believe that Stackmail is DKIM signed

Isaac McFadyen•3/24/25, 7:25 PM

Oh actually you have an emdash instead of a dash in front of allall

WWTDawson9 Looks fine to me

DarkDeviLOP•3/24/25, 7:25 PM

(I would probably go as far as to ignore everything that MxToolbox is shouting in your direction.

)

Isaac McFadyen•3/24/25, 7:25 PM

—all—all (emdash) versus -all-all (correct)

WTDawson9•3/24/25, 7:26 PM

Ah right, Stackmail clearly isn't DKIM signed (My test email got rejected)

WWTDawson9 I believe that Stackmail is DKIM signed

DarkDeviLOP•3/24/25, 7:26 PM

If your legitimate flows are failing, they will be rejected too.

And assuming that the DMARC reports above were legitimate mails from you, that crossed through them, you would then fail.

WTDawson9•3/24/25, 7:27 PM

I'll send some more emails and see if the number goes up

WTDawson9•3/24/25, 7:27 PM

Two secs

WTDawson9•3/24/25, 7:28 PM

Idk how often it updates tbf

DarkDeviLOP•3/24/25, 7:28 PM

It may take a (long) while, ... DMARC aggregate reports are generally sent once per 24 hours at most.

WTDawson9•3/24/25, 7:29 PM

Alright

WTDawson9•3/24/25, 7:29 PM

Well, I will come back to this tomorrow

WTDawson9•3/24/25, 7:33 PM

Oh and also, if I try to enable this, it just never does anything
It appears like the API route that ends with bot_managementbot_management just doesn't respond

WTDawson9•3/24/25, 7:34 PM

Irma•3/24/25, 7:37 PM

Hello, my name is Irma and I have questions about 5 warnings that appeared during DNS health check:DNS DMARC RUA / RUF domains Not valid. Reverse DNS does not match SMTP Banner. SOA Expire Value is out of recommended range. SOA Serial Number Format is Invalid. Also, email for RUA was not mine. How this can be fixed? Thank you in advance!