Payne, John wrote:

> Yeah, but why are they showing up in _my_ DMARC reports?
...
> Domain  MAIL FROM       DKIM domain     SPF Auth        DKIM Auth       Total
> akamai.com<http://akamai.com> 
> oppa.com.br<https://urldefense.proofpoint.com/v2/url?u=http-3A__oppa.com.br&d=DQMFaQ&c=96ZbZZcaMF4w0F4jpN6LZg&r=VZB3mxoaHOufiSM5PmcFdSC3X7QyR-UqbTVl9O2GXVI&m=muN8iCc9IrsFz5Xpe1BKqQYoYLfDoE09qlNlu578rB0&s=rtlqCpIg6ZivlkZLSgiF1miH_AHJoPh4RFuE_99I4oo&e=>
>  
> oppa-com-br.20150623.gappssmtp.com<https://urldefense.proofpoint.com/v2/url?u=http-3A__oppa-2Dcom-2Dbr.20150623.gappssmtp.com&d=DQMFaQ&c=96ZbZZcaMF4w0F4jpN6LZg&r=VZB3mxoaHOufiSM5PmcFdSC3X7QyR-UqbTVl9O2GXVI&m=muN8iCc9IrsFz5Xpe1BKqQYoYLfDoE09qlNlu578rB0&s=2WRrk-QbD3c6SGDsxBoU0dJ8hH4NobkdIQA5HLv8lqc&e=>
>  Pass  Pass    237

oppa.com.br has a syntactically invalid SPF record, so it's odd that it's 
passing at all. You didn't show which IP address the reporter saw this stream 
coming from: were they forwarded in your environment with their DKIM signatures 
intact?

- Roland
_______________________________________________
dmarc-discuss mailing list
dmarc-discuss@dmarc.org
http://www.dmarc.org/mailman/listinfo/dmarc-discuss

NOTE: Participating in this list means you agree to the DMARC Note Well terms 
(http://www.dmarc.org/note_well.html)

Reply via email to