Want to subscribe to topics you're interested in?
Become a Member

Email Free Weekly DMARC Email Reports for Your Domain from Postmark

Discussion in 'Domains, DNS, Email & SSL Certificates' started by deltahf, Apr 12, 2016.

  1. deltahf

    deltahf Premium Member Premium Member

    377
    175
    43
    Jun 8, 2014
    Ratings:
    +290
    Local Time:
    5:44 AM
    I've found a neat tool from Postmark which collects DMARC reports about emails sent from your domain by email providers, and sends you a weekly email summarizing what it finds. It's a very interesting way to find out if your domain is being abused - I was shocked to find that over 2,000 emails have been sent from my domain via unauthorized sources in the past week. :eek:

    Check it out here: DMARC Weekly Digests by Postmark
     
  2. eva2000

    eva2000 Administrator Staff Member

    45,467
    10,319
    113
    May 24, 2014
    Brisbane, Australia
    Ratings:
    +16,005
    Local Time:
    7:44 PM
    Nginx 1.19.x
    MariaDB 5.5/10.x
    Agreed been using Postmark's DMARC services for ages now :D
     
  3. deltahf

    deltahf Premium Member Premium Member

    377
    175
    43
    Jun 8, 2014
    Ratings:
    +290
    Local Time:
    5:44 AM
    What are the typical failed percentages in your weekly reports?

    My first report seems high (19% failure).
     
  4. eva2000

    eva2000 Administrator Staff Member

    45,467
    10,319
    113
    May 24, 2014
    Brisbane, Australia
    Ratings:
    +16,005
    Local Time:
    7:44 PM
    Nginx 1.19.x
    MariaDB 5.5/10.x
    I get between 0-20% failure/untrusted sources across 200+ domain hostnames.

    You're probably interpreting untrusted sources/failures incorrectly. A bit more about untrusted sources/failures DMARC Untrusted Sources - Postmark Help

     
  5. deltahf

    deltahf Premium Member Premium Member

    377
    175
    43
    Jun 8, 2014
    Ratings:
    +290
    Local Time:
    5:44 AM
    Yeah, I read that page. I guess these are just messages from my domain being forwarded or relayed elsewhere, but it caught my attention because many of the mail servers were from India, Brazil, and Mexico - none of which are particularly heavy traffic countries for my website - and made me suspect spam.
     
  6. eva2000

    eva2000 Administrator Staff Member

    45,467
    10,319
    113
    May 24, 2014
    Brisbane, Australia
    Ratings:
    +16,005
    Local Time:
    7:44 PM
    Nginx 1.19.x
    MariaDB 5.5/10.x
    make sure your dns is setup properly too. I had one of my domains with alot of failure/untrusted sources and it turns out the parked domain had the wrong DNS A record IP set. After I moved servers, I forgot to update that parked domain's DNS A record IP address. So SPF/DKIM checks when they looked up the A record IP it was resolving to incorrect server IP :whistle:
     
  7. deltahf

    deltahf Premium Member Premium Member

    377
    175
    43
    Jun 8, 2014
    Ratings:
    +290
    Local Time:
    5:44 AM
    Some odd domains in my "untrusted sources" report this week...
    Code:
    spectacularsunset.net
    chunkyplatform.com
    limitedmeans.com
    culturalevent.net
    celebreationfeaturing.net
    surroundingtribal.com
    o_O
     
  8. eva2000

    eva2000 Administrator Staff Member

    45,467
    10,319
    113
    May 24, 2014
    Brisbane, Australia
    Ratings:
    +16,005
    Local Time:
    7:44 PM
    Nginx 1.19.x
    MariaDB 5.5/10.x
    heh .. yeah I got a hand full too - probably investigate later on when I have more free time. Working out my plans for DDOS protection for the forums :)
     
  9. BamaStangGuy

    BamaStangGuy Premium Member Premium Member

    651
    189
    43
    May 25, 2014
    Ratings:
    +264
    Local Time:
    4:44 AM
    Glad I found this. I setup a DMARC for each domain a month or so ago and have been looking at them manually.
     
  10. BamaStangGuy

    BamaStangGuy Premium Member Premium Member

    651
    189
    43
    May 25, 2014
    Ratings:
    +264
    Local Time:
    4:44 AM
    Got my first one today:

    Screenshot 2017-04-10 04.35.22.png
     
  11. eva2000

    eva2000 Administrator Staff Member

    45,467
    10,319
    113
    May 24, 2014
    Brisbane, Australia
    Ratings:
    +16,005
    Local Time:
    7:44 PM
    Nginx 1.19.x
    MariaDB 5.5/10.x
    nice. small volume for me :)

    upload_2017-4-10_21-55-17.png
     
  12. BamaStangGuy

    BamaStangGuy Premium Member Premium Member

    651
    189
    43
    May 25, 2014
    Ratings:
    +264
    Local Time:
    4:44 AM
    It actually was helpful. One of our sites was missing an SPF record but still had its DKIM setup properly.
     
  13. eva2000

    eva2000 Administrator Staff Member

    45,467
    10,319
    113
    May 24, 2014
    Brisbane, Australia
    Ratings:
    +16,005
    Local Time:
    7:44 PM
    Nginx 1.19.x
    MariaDB 5.5/10.x
    Yeah DMARC reports have helped me troubleshoot setups too :)
     
  14. buik

    buik “A winner never stops trying.” Premium Member

    1,309
    361
    83
    Apr 29, 2016
    Ratings:
    +1,075
    Local Time:
    10:44 AM
    This is serious business :) and a serious mail volume.
    As you are using centminmod and regularly ask for advice on this forum.
    A donation to @eva2000 seems logical and justified to me.
    My two cents;)
     
  15. BamaStangGuy

    BamaStangGuy Premium Member Premium Member

    651
    189
    43
    May 25, 2014
    Ratings:
    +264
    Local Time:
    4:44 AM
    Who says I haven't? Thanks for the unsolicited advice on what to do with my money though.
     
  16. EckyBrazzz

    EckyBrazzz Active Member

    873
    183
    43
    Mar 28, 2018
    >>>>Click here<<<< i'm nearby......
    Ratings:
    +334
    Local Time:
    6:44 AM
    Latest
    Latest
    ok. 0,02$, but it's expensive to transfer only 0,02$ from Brasil to Brisbaine.