Join the community today
Become a Member

Email Free Weekly DMARC Email Reports for Your Domain from Postmark

Discussion in 'Domains, DNS, Email & SSL Certificates' started by deltahf, Apr 12, 2016.

  1. deltahf

    deltahf Active Member

    207
    101
    43
    Jun 8, 2014
    Ratings:
    +154
    Local Time:
    6:39 PM
    I've found a neat tool from Postmark which collects DMARC reports about emails sent from your domain by email providers, and sends you a weekly email summarizing what it finds. It's a very interesting way to find out if your domain is being abused - I was shocked to find that over 2,000 emails have been sent from my domain via unauthorized sources in the past week. :eek:

    Check it out here: DMARC Weekly Digests by Postmark
     
    • Like Like x 1
  2. eva2000

    eva2000 Administrator Staff Member

    30,194
    6,789
    113
    May 24, 2014
    Brisbane, Australia
    Ratings:
    +10,144
    Local Time:
    8:39 AM
    Nginx 1.13.x
    MariaDB 5.5
    Agreed been using Postmark's DMARC services for ages now :D
     
    • Like Like x 1
  3. deltahf

    deltahf Active Member

    207
    101
    43
    Jun 8, 2014
    Ratings:
    +154
    Local Time:
    6:39 PM
    What are the typical failed percentages in your weekly reports?

    My first report seems high (19% failure).
     
  4. eva2000

    eva2000 Administrator Staff Member

    30,194
    6,789
    113
    May 24, 2014
    Brisbane, Australia
    Ratings:
    +10,144
    Local Time:
    8:39 AM
    Nginx 1.13.x
    MariaDB 5.5
    I get between 0-20% failure/untrusted sources across 200+ domain hostnames.

    You're probably interpreting untrusted sources/failures incorrectly. A bit more about untrusted sources/failures DMARC Untrusted Sources - Postmark Help

     
  5. deltahf

    deltahf Active Member

    207
    101
    43
    Jun 8, 2014
    Ratings:
    +154
    Local Time:
    6:39 PM
    Yeah, I read that page. I guess these are just messages from my domain being forwarded or relayed elsewhere, but it caught my attention because many of the mail servers were from India, Brazil, and Mexico - none of which are particularly heavy traffic countries for my website - and made me suspect spam.
     
  6. eva2000

    eva2000 Administrator Staff Member

    30,194
    6,789
    113
    May 24, 2014
    Brisbane, Australia
    Ratings:
    +10,144
    Local Time:
    8:39 AM
    Nginx 1.13.x
    MariaDB 5.5
    make sure your dns is setup properly too. I had one of my domains with alot of failure/untrusted sources and it turns out the parked domain had the wrong DNS A record IP set. After I moved servers, I forgot to update that parked domain's DNS A record IP address. So SPF/DKIM checks when they looked up the A record IP it was resolving to incorrect server IP :whistle:
     
    • Like Like x 1
  7. deltahf

    deltahf Active Member

    207
    101
    43
    Jun 8, 2014
    Ratings:
    +154
    Local Time:
    6:39 PM
    Some odd domains in my "untrusted sources" report this week...
    Code:
    spectacularsunset.net
    chunkyplatform.com
    limitedmeans.com
    culturalevent.net
    celebreationfeaturing.net
    surroundingtribal.com
    o_O
     
    • Funny Funny x 1
  8. eva2000

    eva2000 Administrator Staff Member

    30,194
    6,789
    113
    May 24, 2014
    Brisbane, Australia
    Ratings:
    +10,144
    Local Time:
    8:39 AM
    Nginx 1.13.x
    MariaDB 5.5
    heh .. yeah I got a hand full too - probably investigate later on when I have more free time. Working out my plans for DDOS protection for the forums :)
     
    • Like Like x 1
  9. BamaStangGuy

    BamaStangGuy Active Member

    470
    137
    43
    May 25, 2014
    Ratings:
    +180
    Local Time:
    5:39 PM
    Glad I found this. I setup a DMARC for each domain a month or so ago and have been looking at them manually.
     
    • Like Like x 2
  10. BamaStangGuy

    BamaStangGuy Active Member

    470
    137
    43
    May 25, 2014
    Ratings:
    +180
    Local Time:
    5:39 PM
    Got my first one today:

    Screenshot 2017-04-10 04.35.22.png
     
    • Informative Informative x 2
  11. eva2000

    eva2000 Administrator Staff Member

    30,194
    6,789
    113
    May 24, 2014
    Brisbane, Australia
    Ratings:
    +10,144
    Local Time:
    8:39 AM
    Nginx 1.13.x
    MariaDB 5.5
    nice. small volume for me :)

    upload_2017-4-10_21-55-17.png
     
  12. BamaStangGuy

    BamaStangGuy Active Member

    470
    137
    43
    May 25, 2014
    Ratings:
    +180
    Local Time:
    5:39 PM
    It actually was helpful. One of our sites was missing an SPF record but still had its DKIM setup properly.
     
    • Like Like x 1
  13. eva2000

    eva2000 Administrator Staff Member

    30,194
    6,789
    113
    May 24, 2014
    Brisbane, Australia
    Ratings:
    +10,144
    Local Time:
    8:39 AM
    Nginx 1.13.x
    MariaDB 5.5
    Yeah DMARC reports have helped me troubleshoot setups too :)
     
  14. bassie

    bassie Active Member

    535
    116
    43
    Apr 29, 2016
    Ratings:
    +348
    Local Time:
    12:39 AM
    This is serious business :) and a serious mail volume.
    As you are using centminmod and regularly ask for advice on this forum.
    A donation to @eva2000 seems logical and justified to me.
    My two cents;)
     
    • Like Like x 1
  15. BamaStangGuy

    BamaStangGuy Active Member

    470
    137
    43
    May 25, 2014
    Ratings:
    +180
    Local Time:
    5:39 PM
    Who says I haven't? Thanks for the unsolicited advice on what to do with my money though.
     
    • Like Like x 1