What use can I make of DMARC reports?
 

I have several domains, all with low volume of email. All are configured for DKIM reporting using opendkim. The report volume is getting out of hand. Just yesterday I had 26 reports come into my email. While I guess these reports are allegedly good for seeing if my domain is being spoofed, I don't really know how to determine that or what to do about it. Below is one of the reports I got yesterday:
My domain is horeb-wright3.org. Does this report mean that cadge.hojgdt.cn is spoofing my domain? If so, how to I prevent cadge.hojgdt.cn from doing so? Why is reporting@dmarc25.jp telling me about this. If this report doesn't mean that, what does it mean?

Hello Mfoley,

I'm no expert at all but the following is what I do:

1. I use a combination of OpenDKIM (Installed and configured locally) / SPF (configured via your DNS records) / DMARC (again configured via your DNS records) - utilising all 3 will reduce the chances of your domain being spoofed.
2. Ensure your mail server is not currently set as an Open Relay - there are a large no.of tools you can use to test this such as: https://mxtoolbox.com/diagnostic.aspx - SMTP diagnostics test.
3. Use a DMARC report analyser such as: https://eu.dmarcadvisor.com/dmarc-xml/ OR https://us.dmarcian.com/dmarc-xml/ just to confirm there are no issues - they allow you to upload your XML files.

The following is essentially what I use (via a quick Google) and includes remediation steps - i'm guessing as you have Senior status on here this may be something you already have in place:

- Enable DMARC ReportingFirst, ensure you have an active DMARC record published in your DNS that includes a reporting email address. Your DMARC TXT record should look something like this:v=DMARC1; p=none; rua=mailto:dmarc-reports@yourdomain.com; pct=1002.

- Identify Spoofing IndicatorsOnce you start receiving XML reports (or using a DMARC visualization tool), look for these key data points:Unrecognized IP Addresses: Check the <source_ip> field in the report. If an unfamiliar IP address is sending emails that claim to come from your domain, it is likely a spoofing attempt.

- Failed SPF (spf) or DKIM (dkim) Status: Check the <auth_results> section. If the sending IP does not match your authorized SPF records, or if the digital signature (DKIM) fails or is missing, the authentication check will fail.

As in my case I get an SPF fail because I am using a standard household dynamic IP Address and not a static business one therefore my SPF resolves to my ISP

- DMARC Failure: If both SPF and DKIM fail (or lack "alignment" with your domain), the dmarc_result will show as fail.

- Take ActionAnalyze Legitimate Senders First: Ensure that failing emails are not actually coming from a legitimate third-party service (e.g., Mailchimp, Salesforce) that you forgot to authorize in your SPF or DKIM setup.Upgrade Your Policy: If the failing IPs are definitively not yours, you are being spoofed. Once all legitimate sending sources are verified and authenticated, update your DMARC policy from p=none (monitoring only) to p=quarantine or p=reject to block spoofed emails from reaching inboxes.

- Useful Tools to Read ReportsRaw DMARC XML reports are dense and difficult to read manually. You can use DMARC parsing and visualization services to easily spot spoofers and unauthorized IPs:MXToolboxPostmark DMARCDMARC Analyzer

One thing I noticed is that you have 2 <source_ip> entries - 1 of them should be your WAN address but what does the other IP correspond to?


A lookup on the domain hojgdt.cnm reveals the following per: https://whois.domaintools.com/hojgdt.cn - there's a few potential red flas there:

- View the information concverning the IP / Hosting History
- The registrant contact email address looks suspect.


Via a couple of scanners:

https://www.bitdefender.com/en-us/co...cker/malicious - if you enter the domain hojgdt.cn it provides a warning

https://www.brightcloud.com/tools/url-ip-lookup.php

Whilst https://www.virustotal.com/gui/url/8...e06e4236222b74 - Fortinet flags it as a potential spammer

https://www.abuseipdb.com/check/118.103.125.98 - report it as an SMTP scanner attempting to use customer mailservers as relays.


Hope the above helps somewhat.

Regards,

Rawcous

check out this: https://www.emailsherlock.com/resources/domain_spoofing

Best Practices Copied from Copilot:

Apply SPF, DKIM, and DMARC to all domains, even those not actively sending email.

Start with DMARC p=quarantine before moving to p=reject to avoid accidental blocking.

Regularly review DMARC reports to detect unauthorized senders.

Test your setup using tools like NCSC’s email security check.
https://www.ncsc.gov.uk/collection/e...ce=copilot.com

Yes, someone is absolutely spoofing your domain. The report shows an IP trying to send mail as you, but because the signature was from cadge.hojgdt.cn, DMARC correctly threw a fail since it doesn't align with your domain.

The short answer is: you can't stop spammers from putting your domain in the 'From' header. But as long as your DMARC is set to p=reject, receiving servers will just drop their garbage.

You're getting flooded with these XML files because your DNS TXT record has the rua= tag in it. If the volume is driving you crazy and you are confident your mail flow is working fine, just remove that tag from your DNS record. The protection stays, but the annoying emails stop.