I've been monitoring our DMARC compliance with policy "p=none" for a month or two using both dmarcian and dmarcanalyzer. I've noticed that when we send a large email marketing campaign (10k+ emails), there is a spike in mail that fails DMARC that seems to be from the campaign.
My company sends marketing emails to our clients using Pardot, and Pardot sends emails using a 5321.MailFrom address with a domain of "bounce.s7.exacttarget.com".
We have set up our DKIM keys properly in Pardot and have SPF records on our domain that allow their servers to send mail on our behalf. I also know that since the Pardot emails are sent from "bounce.s7.exacttarget.com", we'll never be in DMARC alignment for SPF.
So the problem is, if we send 10,000 emails to our clients, I'm only seeing DMARC aggregate report successes (using DKIM) for 1,000-1,500 emails. (I assume its normal for only a percentage of mail servers to send aggregate reports?) And I see a spike of DMARC aggregate report failures for 100-500 emails.
Many of these show DKIM fail for our domain which is puzzling, and many show DKIM fail for a different domain altogether. I've looked up a few of the domains that failed DKIM, and the numbers to those domains seem to match emails that were sent to that domain via our campaign.
This sounds like the email hit a mail server and then was forwarded which broke the DKIM signature.
Does that sound likely to you?
How do I get legitimate marketing emails to our customers to pass DMARC when there may be forwarding going on?
No comments:
Post a Comment