Hi, I’m pretty new to everything DMARC and I’m having trouble figuring something out.
I’ve been using dmarcian for about a month now with everything showing up fine, until today.
Can anyone please let me know what went wrong there? And is there a way to find out which emails exactly the report is talking about?
Thank you!
Edit: I’ve also asked SiteGround support about this and they’re asking me for the header of one of those emails, which unfortunately I don’t know how to identify.
You may be able to get headers for mails failing DKIM by adding fo=d; ruf=@coumba.win to your dmarc record.
Where would I then find them?
I could also get the headers from the emails themselves if I just knew which ones are the ones that failed DKIM. Right now I can’t see any way of finding that out from dmarcian.
If you change your DMARC record to e.g.
_dmarc.coumba.win text = “v=DMARC1; p=quarantine; pct=50; rua=mailto:fuyz4xlq@ag.dmarcian.com; fo=d; ruf=mailto:fuyz4xlq@fr.dmarcian.com,mailto:yourmail@coumba.win”
then forensic reports for mail failing DKIM will be sent to yourmail@coumba.win, and to your Dmarcian account.
Thanks, I’ve made the changes and I’ll be on the lookout in case this happens again in the future.
In the meantime, any idea why this would happen? Or what exactly happened? Like I said, I’m pretty new to this stuff.
The use of “signing.refused” as the DKIM d= is
a) invalid
b) virtually certain to have been introduced on the service which correctly signed the other messages
c) indicative of some sort of configuration problem on the signing service -either generally on the service itself, or somehow correlated to your domain hosted there.
Although @opvind 's suggestion of fo=d is a good one and you should try it, be aware that very few environments report any kind of RUF data.
Thanks!
SiteGround support said there was probably some kind of temporary issue, but that otherwise everything is set up correctly. Guess there’s not much else to say, I don’t know.
