Author Topic: DMARC error  (Read 867 times)

Per E. Johannessen

  • Full Member
  • ***
  • Posts: 193
  • Karma: +3/-0
    • View Profile
DMARC error
« on: August 17, 2022, 01:26:17 pm »
Hi,

I'm sending a lot of e-mails with Seamonkey 2.35 and it woks fine.
However, I've now been informed by one recipient (a company) that the e-mail I sent them has a "DMARC-error".

Got the following info from them;
---
Error info: Sender Policy Framework (SPF) error.

DMARC error. This error means that the message failed authentication tests and is not DMARC Compliant.
A DMARC Compliance failure means that both SPF & DKIM verification tests failed.
---

Anyone who knows aything about this?

Roderick Klein

  • Hero Member
  • *****
  • Posts: 547
  • Karma: +14/-0
    • View Profile
Re: DMARC error
« Reply #1 on: August 17, 2022, 02:22:35 pm »
The domain name that is your email address is SPF and DMARC setup correctly ?

Goto https://mxtoolbox.com/ and put your domain name to check if stuff is setup correctly.
Is your SPF record also needs to have the correct entries.

Roderick Klein

Sean Casey

  • Full Member
  • ***
  • Posts: 118
  • Karma: +2/-0
    • View Profile
Re: DMARC error
« Reply #2 on: August 17, 2022, 05:51:19 pm »
The receiving mail server looked at your DNS entries for DKIM and then SPF to validate your mail server's identity.   Your mail server's public encryption key is included in your mail server's DNS DKIM entry, usually in the form of:
   
     v=DKIM1;p=<public key here>

You can identify your DKIM record using this site: https://dnschecker.org/dkim-record-checker.php

Your mail server's DNS SPF entry tells the other mail server if it should accept mail from one or more mail servers for your domain.   My mail server's SPF record identifies a single mail server and looks like this:

     v=spf1 ip4:<IP address here> -all

You can use this site to view your SPF record details:  https://dnschecker.org/spf-record-validation.php


Per E. Johannessen

  • Full Member
  • ***
  • Posts: 193
  • Karma: +3/-0
    • View Profile
Re: DMARC error
« Reply #3 on: August 17, 2022, 09:31:31 pm »
Thanks guys, I've sent a PM to both of you.

Martin Iturbide

  • OS2World NewsMaster
  • Global Moderator
  • Hero Member
  • *****
  • Posts: 3878
  • Karma: +38/-0
  • Your Friend Wil Declares...
    • View Profile
    • Martin's Personal Blog
Re: DMARC error
« Reply #4 on: August 17, 2022, 10:26:09 pm »
Hi Per.

I suffered a similar issue for my office domain email hosting. In my case the mxtool reported me that I need to enable a "DMARC Quarantine/Reject policy".

I have a simple hosting with HostGator. I went to the portal, go to CPanel - Domain - Zone Editor. There I added a new MX Record for my domain:
- _dmarc.yourdomain.com.
- 14400
- TXT
- v=DMARC1;p=quarantine;sp=none;adkim=r;aspf=r;pct=100;fo=1;rf=afrf;ri=86400;rua=mailto:email@yourdomain.com;ruf=mailto:email@yourdomain.com

I just followed some instructions, I don't know exactly what mean each of the parameters. But from that moment my DMARC issue was gone.

Regards
Martin Iturbide
OS2World NewsMaster
... just share the dream.

Sean Casey

  • Full Member
  • ***
  • Posts: 118
  • Karma: +2/-0
    • View Profile
Re: DMARC error
« Reply #5 on: August 18, 2022, 12:22:36 am »
v=DMARC1;p=quarantine;sp=none;adkim=r;aspf=r;pct=100;fo=1;rf=afrf;ri=86400;rua=mailto:email@yourdomain.com;ruf=mailto:email@yourdomain.com

The DMARC entry is a recommendation provided to the receiving server on how to handle email received from Per's mail server that doesn't satisfy SPF and DKIM security checks.  Per's entry is communicating "relaxed/none" policies (i.e., don't reject/quarantine, no actions to be taken), so I don't see his DMARC record getting in the way of delivering his mail. 

Per is using a third party's mail server to host his domain and his SPF record seemed okay for that purpose, but I can't see his DKIM record.   If he doesn't have a DKIM record set up, he likely can identify the means to have the mail server generate a secure public key for his domain which he will need to use to create his DNS DKIM record. 

I host my own mail server, and after 18 years, I recently moved DNS from my ISP to a different DNS services provider which required me to brush up on creating DNS records.   My ISP managed my DNS entries and it was nearly impossible to talk to anyone who could make needed changes.  My new DNS services provider has now provided me full access to set up and manage DNS.   Unfortunately, I still need to work with my ISP to manage my reverse DNS entries.
« Last Edit: August 18, 2022, 12:44:01 am by Sean Casey »

Per E. Johannessen

  • Full Member
  • ***
  • Posts: 193
  • Karma: +3/-0
    • View Profile
Re: DMARC error
« Reply #6 on: August 18, 2022, 05:47:01 pm »
Turns out that I've been using my ISP's mailserver for outgoing mail and they don't add DKIM to the mails.
My web hosting provider adds all needed automatically to the emails so I'm using their mailserver from now on.

Sean Casey, many thanks for teaching me a lot about email settings/security.