Questions[dmarc](server)

I created website for someone, but also someone (I guess some SEO guy) told this person that I made big mistake because there are missing DNS records on domain (mx, SPF, dmarc). Now I need to "fix" my error.

Thing is, of course these records are used for Email purposes, but there is NO email in this domain (just simple free Gmail account).

So, is there any reason to add these records anyway? How they should look like? Only reason I can think of is preventing SPAM using my domain identity. But I thought that SPAM filters are not going to pass email from my domain anyway if these records are missing, so what's the point?

Is there a way to enforce DMARC to fail/reject mail that doesn't pass BOTH DKIM and SPF?

We have been narrowing the number that are failing, but there are some domains in our aggregate (rua) report that are passing just DKIM and we would rather that they fail our DMARC because we don't recognize them.

The domains that we do recognize are fully-aligned.

Our end goal is that unless it is fully aligned (both DKIM AND SPF), the message will be rejected

I've searched all over Google and unable to find why these reports are named "rua" and "ruf".

They don't seem random, but also don't appear to easily translates in an obvious way to their definitions.

From the DMARC RFC:

rua: Addresses to which aggregate feedback is to be sent

ruf: Addresses to which message-specific forensic information is to be reported

Ok so I'm guessing maybe the "a" maps to "aggregate" and "f" maps to forensic. But what does the "ru" part mean?

Whenever my domain sends a message to a google group on another domain the DMARC alignment fails. This is true for all my approved senders, even using Gmail in my domain. It seems to be because the Return-Path (Envelope From) header is replaced by the receiving group's bounce address, but the From header remains as my domain, which is incorrect.

For example, I send mail from Gmail in my domain, [email protected], to a group in your domain, [email protected]. If you look at the headers of the message you receive, you see:

BAD

Return-Path: <[email protected]>
Authentication-Results: mx.google.com;
   dkim=pass [email protected];
   spf=pass (google.com: domain of [email protected] designates 2607:f8b0:400d:c04::246 as permitted sender)
smtp.mailfrom=your-group+bncBCA5XFGRYQLCBEHHVS5AKGQED3J2I7I@yourdomain.com;
   dmarc=fail (p=NONE dis=NONE) header.from=mydomain.com
From: Chris <[email protected]>

X-Original-Sender: [email protected]
X-Original-Authentication-Results: mx.google.com;       dkim=pass
 [email protected];       spf=pass (google.com: domain of [email protected]
 designates 2607:f8b0:400c:c05::233 as permitted sender)
[email protected];
       dmarc=pass (p=NONE dis=NONE) header.from=mydomain.com

DMARC fails because of bad alignment between the From domain (mydomain) and the DKIM and SPF domains (yourdomain). However, when you, a properly configured GApps user, send mail from Gmail to a group at mydomain, the headers are different.

GOOD

Return-Path: <[email protected]>
Authentication-Results: mx.google.com;
       dkim=pass [email protected];
       spf=pass (google.com: domain of [email protected] designates 2607:f8b0:4001:c0b::247 as permitted sender) smtp.mailfrom=my-group+bncBCGJ3NF22YBRBTXIVS1RKGQEIWR5E6Q@mydomain.com;
   dmarc=pass (p=NONE dis=NONE) header.from=mydomain.com
From: "'You' via my-group" <my-group@ mydomain.com>

Note the different form of the From header - the original sender has been replaced by my own group. There is also a pair of X-Original headers as above that have the same form (just reversed), so I'm not pasting them.

So the question is, how do I configure my domain, gapps, dns, mx, or whatever, so that Google Groups that receive my messages will correctly replace the From header with "via [email protected] ?"

Mail from my domain to users at other domains work fine - DMARC passes because SPF and DKIM are good and the Return-Path still says @mydomain. I have read articles about why the "via you-group" is necessary - I'm ok with that. I'm trying to figure why my messages to groups are not getting treated that way.

Seems to be similar to: How to prevent emails from my domain through mailing lists to be rejected due to DMARC Different because google groups are definitely compatible with DMARC - other people don't have this problem.

Update: I found this article which says google groups only rewrites the sender when the DMARC policy is strict (p=reject). That seems like a terrible idea since the whole point of starting with p=none is to gain confidence that your mail will get delivered when you up the policy, but if true then it may explain my issue. Can anyone confirm? http://www.spamresource.com/2014/04/google-groups-rewriting-from-addresses.html

If i sent a mail from my website (on a private server) to [email protected], i have this report :

 <record>
  <row>
   <source_ip>x.x.x.x</source_ip>
   <count>1</count>
   <policy_evaluated>
    <disposition>none</disposition>
    <dkim>pass</dkim>
    <spf>fail</spf>
   </policy_evaluated>
  </row>
  <identifiers>
   <header_from>mydomain.com</header_from>
  </identifiers>
  <auth_results>
   <spf>
    <domain>mydomain.com</domain>
    <result>pass</result>
   </spf>
   <dkim>
    <domain>mydomain.com</domain>
    <result>pass</result>
   </dkim>
  </auth_results>
 </record>

The identifiers/header_from AND auth_results/spf/domain is both mydomain.com, my sender (and return path) is [email protected]

The SPF test alone is ok, but the dmarc (policy_evaluated/spf) fail, i don't understand why ...

My DNS record (SPF/DMARC):

"v=spf1 a mx include:mx.ovh.com -all"

"v=DMARC1\; p=reject\; sp=none\; rua=mailto:[email protected]\; rf=afrf\; pct=100\; ri=86400"