Monitoring DMARC Badsender.com - June 2021

As at the beginning of each month now, we will share with you in this article, our DMARC compliance results!

To summarize: Today, our security policy is at "quarantine", which means that any email with SPF & DKIM authentication failures will be delivered as junk mail to any organization (ISP, Webmails, companies, ...) able to interpret and apply the DMARC security rule.

We have, in time, three two objectives for 2021:

1. Change our security policy from "quarantine" to "reject": we would then ask all ISPs/Webmails/Filters (interpreting DMARC) to reject emails with bad SPF & DKIM authentication.
2. Legitimize all our email flows (and yes, we use several distinct tools for each type of sending - understand, we don't have all our eggs in the same basket :p).
3. Apply a "strict" SPF & DKIM alignment instead of a "relaxed" one: We're plugging EVERYTHING into Badsender.com!

This 3rd point is too complicated to set up (cf. point n°2), we will remain in "relaxed" since all our legitimate flows will be branded with a sub-domain of Badsender.com. And if one day things change... We will study a passage towards a strict alignment!

We are aware that it will take time and energy but it is not impossible! And if it allows us to reduce the risks of using our domain name, it's worth it.

Let's get to the heart of the matter... Enjoy your reading 🙂

June 2021 compliance rate

To be DMARC compliant, the email must return a properly authenticated and properly aligned (soft or hard) SPF or DKIM record.

Here are our results for the month of June 2021 (I am voluntarily keeping the history since the first DMARC monitoring was published to compare the evolution of the data):

Badsender.com	Volumes	Compliant	Non-Compliant	Not Authenticated
June 2021	4 717	99,6%	0,2%	0,2%
May 2021	3 900	99,7%	0,1%	0,2%
April 2021	4 214	99,4%	0,1%	0,5%
March 2021	3 549	99,1%	0,9%	0,0%
February 2021	5 221	99,8%	0,2%	0,0%
January 2021	4 843	98,0%	1,9%	0,1%
December 2020	3 797	99,3%	0,4%	0,3%
November 2020	4 973	98,0%	1,9%	0,1%
October 2020	3 772	95,8%	4,1%	0,1%

Very good compliance rate for this month of June 2021 with over 99% of DMARC compliant reports. Only 7 reports come up as "non-compliant" and 10 "non-authenticated" reports.

Authentication & SPF & DKIM alignment

For an email to be properly authenticated with SPF, the IP used must be declared in the SPF record of the email envelope domain (understand here the MailFrom/Return-path domain - visible in the SMTP header of an email).

For this month of June, we are keeping our SPF validity rate above 96%. When we are further along in our DMARC policy and our infrastructure migration is fully completed (hopefully by the end of the summer), we will optimize - as much as possible - the 3.6% of failure.

And for an e-mail to be correctly aligned with SPF, the domain of the e-mail envelope (here the MailFrom/Return-path) must be identical or from a sub-domain of the FROM domain (cf. domain of the sending address).

A few subflows are showing an alignment problem. We have identified them and will fix some of them during the summer to make them DMARC compliant.

For an email to be properly authenticated with DKIM, the email will need to have a valid DKIM signature (regardless of the domain used in the "d=" statement).

Almost perfect! Our DKIM validity rate for the month of June is excellent, over 99%!

As far as DKIM alignment is concerned, for an e-mail to be correctly aligned, the domain declared in the DKIM signature (contained in the "d=") must be identical to or come from the sub-domain of the FROM domain (cf. domain of the sending address).

Just like the SPF alignment, a few secondary flows are coming up with DKIM alignment issues. We will also fix these during the summer 🙂

The last DKIM-related rate is the rate of unsigned e-mails (and yes, there are still some). These are emails that have no DKIM signature.

Just like last month, we had some unauthenticated reports with a .ru rDNS sender!

Distribution of non-compliant & non-authenticated emails

Here is the list of "Sender rDNS" (understand here the domain name that is associated with an IP) brought up as "non-compliant" over the month of June 2021:

Organization	Sender rDNS	Category	Volumes	Percentage	Source	Action
Microsoft	*.outlook.com	Webmail	4	57%	Known	No action
Google	*.google.com	Webmail	2	29%	Unknown	No action
Alan	*.alan.eu		1	14%	Known	Make it compliant

Only 7 feeds for this month of June 2021. Only Alan's feed (our mutual) will have to be DMARC compliant.

And the list of "Sender rDNS" reported as "unauthenticated":

Organization	Sender rDNS	Category	Volumes	Percentage	Source	Action
Unknown	Unknown	–	3	30%	Unknown	No action
Unknown	*.hoff.ru	–	2	20%	Unknown	No action
Unknown	*.nichost.ru	–	2	20%	Unknown	No action
Microsoft	*.outlook.com	Webmail	1	10%	Unknown	No action
Unknown	*.eyfelshop.ru	–	1	10%	Unknown	No action
Proofpoint	*.pphosted.com	Anti-Spam	1	10%	Unknown	No action

For this month of June, 10 "non-authenticated" reports coming mainly from Russia have been identified. No compliance action will be taken on these flows.

SPF & DKIM error trends

We have the possibility to know on each "Sender rDNS" what are the problems we have encountered and that will be corrected.

Below are the reported trends on SPF & DKIM errors for the month of June 2021:

Trend of the most frequent SPF errors

On the SPF error side, 364 emails report an SPF alignment problem (-8 compared to May), 132 report SPF failure (+34 compared to May), 17 report an SPF authentication problem (+8 compared to May).

Trend of the most frequent DKIM errors

On the DKIM error side, 97 emails trace a DKIM alignment issue (+17 vs. May), 72 trace DKIM failure (+30 vs. May), 7 trace a DKIM authentication issue (+1 vs. May), and 1 traces a permanent error (+1 vs. May).

Our roadmap for this summer!

For this summer (we're thinking big), we'll have a few goals to achieve:

1. Finish our infrastructure migration.
2. Correct the flows to be DMARC compliant.
3. Upgrade our DMARC security policy to "quarantine" by early September.

Conclusion

Just like the previous months, this month of June was rather quiet. The summer is shaping up to be busy and should result in some nice optimizations. Let's finally meet at the beginning of September to know all the changes 🙂

—–

If you too have the ambition to make your email flows DMARC compliant but you don't know where to start, which solution(s) to use... We are here to help you J

—–

Feel free to share, like, comment... In short, make some noise !!!!!

—–

Badsender, emailing expertise agitator! Badsender is a team of craftsmen specialized in the various disciplines surrounding email marketing! Our emailing agency intervenes on questions of strategy, design, orchestration and deliverability. We offer this expertise in the form of coachingWe can also provide services such as audits, or act as an outsourced production force. 

—–

Our other content related to DMARC (from near or far) :

— DMARC monitoring in May 2021

— DMARC monitoring from April 2021

— DMARC monitoring from March 2021

— DMARC monitoring in February 2021

— DMARC monitoring from January 2021

— DMARC monitoring in December 2020

— DMARC Monitoring October vs. November 2020

— Tech 2021 #02 | What if you deploy DMARC in 2021 on your domain name?

— Our White Paper on DMARC deployment

- All about SPF in 3 articles:

         What is SPF? Configuration, verification and monitoring

         10 Tips to implement in your SPF configuration

         How about passing your SPF record to the -all qualifier?

- All about DKIM (1 article only):

         What is DKIM? Configuration, verification and monitoring

- Almost everything you need to know about ARC (1 article so far):

         What is the CRA? Definition, operation and verification

—–

Photo by Randy Tarampi on Unsplash

—–