Google sends DMARC reports for MX FQDN header

MK796

Hello ☺️

For some time now google sends DMARC aggregated reports for headers matching my mail servers hostname.

But!!

Google also sends aggregated reports for headers from my root domain.

So Google therefore thinks that my mail servers subdomain is in fact a mail sending domain. That in fact not correct.

The strange thing is that only Google does this an no one else. Not GMX, Yahoo, Microsoft, AWS, iCloud or every other counterpart.

I’m not sure how to address this…

My question is now: is that somehow related to MTA-STS? Or anything else? I have no clue why they behave like that…

Thank you ☺️

mlcwuser

If the report is coming from noreply-dmarc-support@google.com, it’s DMARC related and contains only domain names from which you’ve sent email to Google Mail services.

If it’s coming from noreply-smtp-tls-reporting@google.com, it’s MTA-STS related. You can disable reporting by removing the TXT record for the `smtp.tls’ subdomain from your DNS. See here: https://support.google.com/a/answer/9276512

MK796 The strange thing is that only Google does this an no one else. Not GMX, Yahoo, Microsoft, AWS, iCloud or every other counterpart.

As far as I know, Google was actually one of the first major email providers to implement and actively push mta-sts, and while many other providers have started to support it as well, they don’t always enforce it strictly. Also, Google seems to be one of the few providers to have TLS-RPT properly implemented, which is probably why you are not getting many TLS reports from other providers.

MK796

mlcwuser thank you for your answer!

I have digged deeper and I think the solution is quite simple and as almost always the dumb a** sits in front of the machine… 😬

I have DMARC reporting enabled on my side (rspamd)

The point here is that I have configure RSPAMD to send DMARC reports with headers from my mail servers FQDN/Hostname instead of from my root domain.

This is not correct and therefore spf and dkim are not aligned and DMARC fails.

So Google reports this to me which is quite nice and reports the Mailservers hostname as not DMARC compliant subdomain. 100% correct behavior.

I will monitor this closely over the next days. When this is in fact the solution I will highlight my own reply to this as the solution ☺️

mlcwuser

MK796 Ah, OK. That makes sense :-)

And yes, Google is one of the very few providers that have actually implemented all the email security features in a 100% standards-compliant way. Of course, that’s also because they’re often at the forefront of developing and pushing new standards, which isn’t always to everyone’s liking, but in this case I think it’s a good thing :-).

MK796

mlcwuser

If google never reported this I would’ve never found out that rspamd is not correctly configured! Therefore kudos to Google for that! 🙂

Regarding TLS-RPT reports, Google is in my case the only counterpart who actually sends TLS-RPT reports to me.

mlcwuser

MK796 Google is in my case the only counterpart who actually sends TLS-RPT reports to me.

Yep. same here.

MK796

Hello again,

So it turns out that my conclusion was not right.

The massage from header is even after changing it in the DMARC.conf not using the root domain for sending out DMARC reports…

Any ideas where to look?

MK796

As it turns out, postfix somehow still sends DMARC reports using my mail servers hostname instead of root domain…

Is that a bug?

IdrisK

In paar i hast the Same issue. Strange is, That only Google discovered this. I did nit found any Solution, so i deactivated the Generation of DMARC Reports by Mailcow.