Ah, so does that mean if someone forwards one of my emails then it may get rejected because of my DM

Ah, so does that mean if someone forwards one of my emails then it may get rejected because of my DMARC records?

DarkDeviL•3/24/25, 7:17 PM

Anyway, as always, I would advice you to:

Verify that all your (valid, legitimate, ...) outbound email streams are properly DKIM signed.
When #1 is done and successful, switch the DMARC policies for your domains to "p=reject; sp=reject; np=reject;p=reject; sp=reject; np=reject;"

After both are successful, receiving infrastructures that validate DMARC (and act properly on them), will then reject messages that neither conform to the DKIM alignment nor SPF alignment, when it ended up on their infrastructure.

WWTDawson9 Ah, so does that mean if someone forwards one of my emails then it may get rejec...

DarkDeviL•3/24/25, 7:18 PM

As your current policy seems to be "nonenone", no action will be taken at the moment.

WTDawson9OP•3/24/25, 7:19 PM

So like v=DMARC1; p=none; rua=*@dmarc-reports.cloudflare.net; p=reject; sp=reject; np=reject;v=DMARC1; p=none; rua=*@dmarc-reports.cloudflare.net; p=reject; sp=reject; np=reject; (Keeping the parts that are already there)

DarkDeviL•3/24/25, 7:19 PM

Your SPF is broken on that

.info

.info

domain though, likely due to copy-pasting in control characters.

It currently ends with " a mx \226\128\147all a mx \226\128\147all".

WTDawson9OP•3/24/25, 7:21 PM

Looks fine to me

WWTDawson9 So like `v=DMARC1; p=none; rua=*@dmarc-reports.cloudflare.net; p=reject; sp=reje...

DarkDeviL•3/24/25, 7:23 PM

You would replace the existing "

p=none

p=none

", instead of having two (or more) duplicated fields.

But as I mentioned above, verify #1 first, for your existing and legitimate email flows.

WWTDawson9 Looks fine to me

Isaac McFadyen•3/24/25, 7:24 PM

I also see the control characters, it's probably not showing them on that specific DNS lookup interface (perhaps because it's being rendered in the HTML as some invisible unicode chars).

DDarkDeviL You would replace the existing "`p=none`", instead of having two (or more) dupli...

WTDawson9OP•3/24/25, 7:24 PM

I believe that Stackmail is DKIM signed

Isaac McFadyen•3/24/25, 7:25 PM

Oh actually you have an emdash instead of a dash in front of allall

WWTDawson9 Looks fine to me

DarkDeviL•3/24/25, 7:25 PM

(I would probably go as far as to ignore everything that MxToolbox is shouting in your direction.

)

Isaac McFadyen•3/24/25, 7:25 PM

—all—all (emdash) versus -all-all (correct)

WTDawson9OP•3/24/25, 7:26 PM

Ah right, Stackmail clearly isn't DKIM signed (My test email got rejected)

WWTDawson9 I believe that Stackmail is DKIM signed

DarkDeviL•3/24/25, 7:26 PM

If your legitimate flows are failing, they will be rejected too.

And assuming that the DMARC reports above were legitimate mails from you, that crossed through them, you would then fail.

WTDawson9OP•3/24/25, 7:27 PM

I'll send some more emails and see if the number goes up

WTDawson9OP•3/24/25, 7:27 PM

Two secs

WTDawson9OP•3/24/25, 7:28 PM

Idk how often it updates tbf

DarkDeviL•3/24/25, 7:28 PM

It may take a (long) while, ... DMARC aggregate reports are generally sent once per 24 hours at most.

WTDawson9OP•3/24/25, 7:29 PM

Alright

WTDawson9OP•3/24/25, 7:29 PM

Well, I will come back to this tomorrow

WTDawson9OP•3/24/25, 7:33 PM

Oh and also, if I try to enable this, it just never does anything
It appears like the API route that ends with bot_managementbot_management just doesn't respond

WTDawson9OP•3/24/25, 7:34 PM

Irma•3/24/25, 7:37 PM

Hello, my name is Irma and I have questions about 5 warnings that appeared during DNS health check:DNS DMARC RUA / RUF domains Not valid. Reverse DNS does not match SMTP Banner. SOA Expire Value is out of recommended range. SOA Serial Number Format is Invalid. Also, email for RUA was not mine. How this can be fixed? Thank you in advance!