The MAIL FROM is not easily spoofed if there is SPF, that's SPF's role. The displayed Header From *is* easily spoofed, which is why we have DMARC. DMARC is based on the displayed Header From that the user sees and matches that domain to either the DKIM or the MAIL FROM, because if the Header From is the same as a 'proven' domain (DKIM is proven by DKIM passing and MAIL FROM is proven by SPF passing), then the displayed Header From is also proven. If the displayed Header From is not the same as a proven domain (DKIM or MAIL FROM), then the DMARC policy (p=__) is consulted to see if the owner of the domain wants the email quarantined or rejected. My best, Zack Aab <http://inboxpros.com/> *Zack Aab | Sr. Deliverability Strategist* <http://linkedin.com/in/zachary-aab/> *Inbox Pros <http://inboxpros.com/> *1995 N Park Place | Suite 300 | Atlanta O: 678.214.3739 | C: 706-870-1061 | z...@inboxpros.com
On Wed, Jan 9, 2019 at 11:54 AM T Nguyen <t.nguye...@outlook.com> wrote: > Thank you Zack for the prompt response. > > The mfrom, MAIL FROM (aka Return-Path aka Envelope-From), is very easily > spoofed and we received lots of spoofing email where Envelope-From is not > aligned with the display "from", where recipients sees the sender email > address. From my understanding that dmarc alignment is based on domain of > this display "from", correct? > ------------------------------ > *From:* Zachary Aab <z...@inboxpros.com> > *Sent:* Wednesday, January 9, 2019 11:30 AM > *To:* Paul Rock > *Cc:* T Nguyen; dmarc-discuss@dmarc.org > *Subject:* Re: [dmarc-discuss] help! > > That is a mistake a LOT of senders make, and it's often the fault of their > ESP which provided incomplete or even wrong information. > Just to reinforce what Paul said: > The Header From IS NOT checked for SPF. The MAIL FROM (aka Return-Path > aka Envelope-From) IS checked for SPF. > My best, > Zack Aab > > <https://nam04.safelinks.protection.outlook.com/?url=http%3A%2F%2Finboxpros.com%2F&data=02%7C01%7C%7Cad80133303de41b7bb4d08d6764fe350%7C84df9e7fe9f640afb435aaaaaaaaaaaa%7C1%7C0%7C636826482818792379&sdata=imfvaUHmoK6aSpR%2Bi154kCg9xuwRmM4TEUPYFea0yBg%3D&reserved=0> > *Zack Aab | Sr. Deliverability Strategist* > <https://nam04.safelinks.protection.outlook.com/?url=http%3A%2F%2Flinkedin.com%2Fin%2Fzachary-aab%2F&data=02%7C01%7C%7Cad80133303de41b7bb4d08d6764fe350%7C84df9e7fe9f640afb435aaaaaaaaaaaa%7C1%7C0%7C636826482818792379&sdata=2jEytKMVd5OD2qF%2FgolSZTPtKNiTcBLqt95wMCnf%2Fcg%3D&reserved=0> > *Inbox Pros > <https://nam04.safelinks.protection.outlook.com/?url=http%3A%2F%2Finboxpros.com%2F&data=02%7C01%7C%7Cad80133303de41b7bb4d08d6764fe350%7C84df9e7fe9f640afb435aaaaaaaaaaaa%7C1%7C0%7C636826482818948621&sdata=NScQ7s4NBocrVp2E3ACUHWMk44fYle6N2xlRfCADxtA%3D&reserved=0> > *1995 N Park Place | Suite 300 | Atlanta > O: 678.214.3739 | C: 706-870-1061 | z...@inboxpros.com > > > On Wed, Jan 9, 2019 at 11:09 AM Paul Rock <paul.r...@teamaol.com> wrote: > > SPF checks run against the actual mfrom domain (or in some cases the > HELO/EHLO domain), in this case it'll check the SPF record for ESP.com, > which passed. SPF doesn't know/care about the from header (and in many > systems, that header hasn't even crossed the wire yet) so it can't do an > SPF check using the from header. That's why DMARC looks at both the > alignment of the SPF domain in question as well as the SPF result. And just > to be clear, the DMARC logic is only looking at the result of a SPF check, > it doesn't try to do one on it's own. Because ESP.com doesn't align with > abc.com > <https://nam04.safelinks.protection.outlook.com/?url=http%3A%2F%2Fabc.com&data=02%7C01%7C%7Cad80133303de41b7bb4d08d6764fe350%7C84df9e7fe9f640afb435aaaaaaaaaaaa%7C1%7C0%7C636826482818948621&sdata=w4v%2Fi0VCn5RABPjrsjUd1tVieHJrchaoMFfVE1EcFlo%3D&reserved=0>, > it fails the SPF portion of the DMARC evaluation. > > On Wed, Jan 9, 2019 at 11:01 AM T Nguyen <t.nguye...@outlook.com> wrote: > > Yes Zack, I meant aSPF relaxed as it's implied without specifically > indicated in dmarc record. > > To clarify ESP.com(111.222.333.444 - source IP) is the external web app > Email Service Provider so abc.com > <https://nam04.safelinks.protection.outlook.com/?url=http%3A%2F%2Fabc.com&data=02%7C01%7C%7Cad80133303de41b7bb4d08d6764fe350%7C84df9e7fe9f640afb435aaaaaaaaaaaa%7C1%7C0%7C636826482818948621&sdata=w4v%2Fi0VCn5RABPjrsjUd1tVieHJrchaoMFfVE1EcFlo%3D&reserved=0> > (MX & DMARC enable) users can send email to large internet groups via > non-MX subdomain u...@xyz.abc.com. ( this subdomain xyz.abc.com > <https://nam04.safelinks.protection.outlook.com/?url=http%3A%2F%2Fxyz.abc.com&data=02%7C01%7C%7Cad80133303de41b7bb4d08d6764fe350%7C84df9e7fe9f640afb435aaaaaaaaaaaa%7C1%7C0%7C636826482818948621&sdata=BG9MZIhIOOeNzgCjCBuV12ozquDoyPuN1Exox2knQrs%3D&reserved=0> > has spf record with include sender ESP.com - note that abc.com > <https://nam04.safelinks.protection.outlook.com/?url=http%3A%2F%2Fabc.com&data=02%7C01%7C%7Cad80133303de41b7bb4d08d6764fe350%7C84df9e7fe9f640afb435aaaaaaaaaaaa%7C1%7C0%7C636826482818948621&sdata=w4v%2Fi0VCn5RABPjrsjUd1tVieHJrchaoMFfVE1EcFlo%3D&reserved=0> > only receives rua for the subdomain but no spf record for ESP.com). > > The second part of the record is very confusing. If the mfrom performs spf > check against abc.com > <https://nam04.safelinks.protection.outlook.com/?url=http%3A%2F%2Fabc.com&data=02%7C01%7C%7Cad80133303de41b7bb4d08d6764fe350%7C84df9e7fe9f640afb435aaaaaaaaaaaa%7C1%7C0%7C636826482818948621&sdata=w4v%2Fi0VCn5RABPjrsjUd1tVieHJrchaoMFfVE1EcFlo%3D&reserved=0> > then it should fail. spf only passes if checking against the subdomain > xyz.abc.com > <https://nam04.safelinks.protection.outlook.com/?url=http%3A%2F%2Fxyz.abc.com&data=02%7C01%7C%7Cad80133303de41b7bb4d08d6764fe350%7C84df9e7fe9f640afb435aaaaaaaaaaaa%7C1%7C0%7C636826482818948621&sdata=BG9MZIhIOOeNzgCjCBuV12ozquDoyPuN1Exox2knQrs%3D&reserved=0> > > > *<identifiers>* > * <header_from>abc.com > <https://nam04.safelinks.protection.outlook.com/?url=http%3A%2F%2Fabc.com&data=02%7C01%7C%7Cad80133303de41b7bb4d08d6764fe350%7C84df9e7fe9f640afb435aaaaaaaaaaaa%7C1%7C0%7C636826482818948621&sdata=w4v%2Fi0VCn5RABPjrsjUd1tVieHJrchaoMFfVE1EcFlo%3D&reserved=0></header_from>* > * </identifiers>* > * <auth_results>* > * * > * <spf>* > * <domain>ESP.com</domain>* > * <scope>mfrom</scope>* > * <result>pass</result>* > * </spf>* > * </auth_results>* > > ------------------------------ > *From:* Zachary Aab <z...@inboxpros.com> > *Sent:* Wednesday, January 9, 2019 10:25 AM > *To:* T Nguyen > *Cc:* Paul Rock; dmarc-discuss@dmarc.org > *Subject:* Re: [dmarc-discuss] help! > > >does DMARC fail even with adfs and adkim implicitly as “r” relaxed? > > By adfs do you mean aspf? If so: yes, "r" aka "relaxed" means that > subdomains of the same parent domain are considered aligned (eg: > sub.abc.com > <https://nam04.safelinks.protection.outlook.com/?url=http%3A%2F%2Fsub.abc.com&data=02%7C01%7C%7Cad80133303de41b7bb4d08d6764fe350%7C84df9e7fe9f640afb435aaaaaaaaaaaa%7C1%7C0%7C636826482818948621&sdata=Mg4pb9x7K6mmIKOZp8%2FZU8l0P5ziuVzOQ0FyULacKZ4%3D&reserved=0> > is aligned with othersub.abc.com > <https://nam04.safelinks.protection.outlook.com/?url=http%3A%2F%2Fothersub.abc.com&data=02%7C01%7C%7Cad80133303de41b7bb4d08d6764fe350%7C84df9e7fe9f640afb435aaaaaaaaaaaa%7C1%7C0%7C636826482818948621&sdata=WqcBjGLcG%2FVYgSkg%2F5YRDKUbIFB3KffbzstifkQwOYE%3D&reserved=0>) > and "s" aka "strict" means that the subdomains must be identical in order > to align. Either way, the authentication (DKIM or SPF) still must share a > parent domain with the Header From. The example shows two different parent > domains: "esp.com > <https://nam04.safelinks.protection.outlook.com/?url=http%3A%2F%2Fesp.com&data=02%7C01%7C%7Cad80133303de41b7bb4d08d6764fe350%7C84df9e7fe9f640afb435aaaaaaaaaaaa%7C1%7C0%7C636826482818948621&sdata=mLYa7dGLDBndX97BmBkOvrPSw8RSxqAFj4TPT%2BgpMuQ%3D&reserved=0>" > in the MAIL FROM and "abc.com > <https://nam04.safelinks.protection.outlook.com/?url=http%3A%2F%2Fabc.com&data=02%7C01%7C%7Cad80133303de41b7bb4d08d6764fe350%7C84df9e7fe9f640afb435aaaaaaaaaaaa%7C1%7C0%7C636826482818948621&sdata=w4v%2Fi0VCn5RABPjrsjUd1tVieHJrchaoMFfVE1EcFlo%3D&reserved=0>" > in the Header From, so they are not aligned and cannot pass DMARC without > changing. > > My best, > Zack Aab > > <https://nam04.safelinks.protection.outlook.com/?url=http%3A%2F%2Finboxpros.com%2F&data=02%7C01%7C%7Cad80133303de41b7bb4d08d6764fe350%7C84df9e7fe9f640afb435aaaaaaaaaaaa%7C1%7C0%7C636826482818948621&sdata=NScQ7s4NBocrVp2E3ACUHWMk44fYle6N2xlRfCADxtA%3D&reserved=0> > *Zack Aab | Sr. Deliverability Strategist* > <https://nam04.safelinks.protection.outlook.com/?url=http%3A%2F%2Flinkedin.com%2Fin%2Fzachary-aab%2F&data=02%7C01%7C%7Cad80133303de41b7bb4d08d6764fe350%7C84df9e7fe9f640afb435aaaaaaaaaaaa%7C1%7C0%7C636826482818948621&sdata=lQYm8RvnFtkmSKYdcfU8LRmUqlbipzC3q3FaWwV9SHs%3D&reserved=0> > *Inbox Pros > <https://nam04.safelinks.protection.outlook.com/?url=http%3A%2F%2Finboxpros.com%2F&data=02%7C01%7C%7Cad80133303de41b7bb4d08d6764fe350%7C84df9e7fe9f640afb435aaaaaaaaaaaa%7C1%7C0%7C636826482818948621&sdata=NScQ7s4NBocrVp2E3ACUHWMk44fYle6N2xlRfCADxtA%3D&reserved=0> > *1995 N Park Place | Suite 300 | Atlanta > O: 678.214.3739 | C: 706-870-1061 | z...@inboxpros.com > > > On Tue, Jan 8, 2019 at 9:01 PM T Nguyen <t.nguye...@outlook.com> wrote: > > > > Thanks Paul, does DMARC fail even with adfs and adkim implicitly as “r” > relaxed? > > > > *From:* Paul Rock <paul.r...@teamaol.com> > *Sent:* Tuesday, January 8, 2019 2:54 PM > *To:* T Nguyen <t.nguye...@outlook.com> > *Cc:* Zachary Aab <z...@inboxpros.com>; dmarc-discuss@dmarc.org > *Subject:* Re: [dmarc-discuss] help! > > > > No, mfrom is the RFC5321 sender (the MAIL FROM: during the SMTP > transaction). The user visible from address is the RFC5322 from header. > Which is why even though it passed SPF, SPF Fails on DMARC evaluation > because 5321 mail from domain of "ESP.com" doesn't align with the 5322 from > header domain of "abc.com > <https://nam04.safelinks.protection.outlook.com/?url=https%3A%2F%2Feur04.safelinks.protection.outlook.com%2F%3Furl%3Dhttp%253A%252F%252Fabc.com%26data%3D02%257C01%257C%257C53714943d1584ad059f608d675a30dd2%257C84df9e7fe9f640afb435aaaaaaaaaaaa%257C1%257C0%257C636825740500389841%26sdata%3DI8dqocrF0Jn%252B5GHEEtT%252FwE9hWu9YhgQSSOYSzOsyrec%253D%26reserved%3D0&data=02%7C01%7C%7Cad80133303de41b7bb4d08d6764fe350%7C84df9e7fe9f640afb435aaaaaaaaaaaa%7C1%7C0%7C636826482818948621&sdata=IiyQUBlBnAFekUw7XnEb3YllgV9tFesZozJ%2BT%2BEzjQU%3D&reserved=0> > " > > > > On Tue, Jan 8, 2019 at 2:27 PM T Nguyen via dmarc-discuss < > dmarc-discuss@dmarc.org> wrote: > > Thanks Jack for your prompt response. > > > > On 3. So this MAIL FROM (mfrom) is the user’s display domain from sender > email address that DMARC uses to align against spf and dkim. > > > > Best, > > Tnguyen > > > On Jan 8, 2019, at 9:52 AM, Zachary Aab <z...@inboxpros.com> wrote: > > 1. Yep > > 2. This is whatever domain was in the Header From (5322.from) of the > emails being described in that row. If any email is sent "from" a > subdomain that doesn't have its own DMARC record (as seen by the receiver), > that subdomain will appear in a <header_from> </header_from> line as well. > > 3. The Aggregate report .xml has been updated to include the DKIM selector > and also the "scope" of the SPF. This is telling you what was used for SPF > authentication for these emails: either the HELO/EHLO or the MAIL FROM (in > your example it is the MAIL FROM "mfrom"). > > > My best, > > Zack Aab > > > <https://nam04.safelinks.protection.outlook.com/?url=https%3A%2F%2Feur04.safelinks.protection.outlook.com%2F%3Furl%3Dhttp%253A%252F%252Finboxpros.com%252F%26data%3D02%257C01%257C%257C53714943d1584ad059f608d675a30dd2%257C84df9e7fe9f640afb435aaaaaaaaaaaa%257C1%257C0%257C636825740500389841%26sdata%3D0CUuhsWHM7eM%252F9qEynkzhkK2aj5Hf%252F5wdFxgw3cUCOY%253D%26reserved%3D0&data=02%7C01%7C%7Cad80133303de41b7bb4d08d6764fe350%7C84df9e7fe9f640afb435aaaaaaaaaaaa%7C1%7C0%7C636826482819104905&sdata=8YNrDyjATBkZdmjjj6wcoryd%2BuModHsfoOiTg6G56Fw%3D&reserved=0> > > *Zack Aab | Sr. Deliverability Strategist > <https://nam04.safelinks.protection.outlook.com/?url=https%3A%2F%2Feur04.safelinks.protection.outlook.com%2F%3Furl%3Dhttp%253A%252F%252Finboxpros.com%252F%26data%3D02%257C01%257C%257C53714943d1584ad059f608d675a30dd2%257C84df9e7fe9f640afb435aaaaaaaaaaaa%257C1%257C0%257C636825740500389841%26sdata%3D0CUuhsWHM7eM%252F9qEynkzhkK2aj5Hf%252F5wdFxgw3cUCOY%253D%26reserved%3D0&data=02%7C01%7C%7Cad80133303de41b7bb4d08d6764fe350%7C84df9e7fe9f640afb435aaaaaaaaaaaa%7C1%7C0%7C636826482819104905&sdata=8YNrDyjATBkZdmjjj6wcoryd%2BuModHsfoOiTg6G56Fw%3D&reserved=0>* > > *Inbox Pros 1995 N Park Place | Suite 300 | Atlanta > <https://nam04.safelinks.protection.outlook.com/?url=https%3A%2F%2Feur04.safelinks.protection.outlook.com%2F%3Furl%3Dhttp%253A%252F%252Finboxpros.com%252F%26data%3D02%257C01%257C%257C53714943d1584ad059f608d675a30dd2%257C84df9e7fe9f640afb435aaaaaaaaaaaa%257C1%257C0%257C636825740500389841%26sdata%3D0CUuhsWHM7eM%252F9qEynkzhkK2aj5Hf%252F5wdFxgw3cUCOY%253D%26reserved%3D0&data=02%7C01%7C%7Cad80133303de41b7bb4d08d6764fe350%7C84df9e7fe9f640afb435aaaaaaaaaaaa%7C1%7C0%7C636826482819104905&sdata=8YNrDyjATBkZdmjjj6wcoryd%2BuModHsfoOiTg6G56Fw%3D&reserved=0>* > > O: 678.214.3739 | C: 706-870-1061 | *z...@inboxpros.com* > <https://nam04.safelinks.protection.outlook.com/?url=https%3A%2F%2Feur04.safelinks.protection.outlook.com%2F%3Furl%3Dhttp%253A%252F%252Finboxpros.com%252F%26data%3D02%257C01%257C%257C53714943d1584ad059f608d675a30dd2%257C84df9e7fe9f640afb435aaaaaaaaaaaa%257C1%257C0%257C636825740500389841%26sdata%3D0CUuhsWHM7eM%252F9qEynkzhkK2aj5Hf%252F5wdFxgw3cUCOY%253D%26reserved%3D0&data=02%7C01%7C%7Cad80133303de41b7bb4d08d6764fe350%7C84df9e7fe9f640afb435aaaaaaaaaaaa%7C1%7C0%7C636826482819104905&sdata=8YNrDyjATBkZdmjjj6wcoryd%2BuModHsfoOiTg6G56Fw%3D&reserved=0> > > > <https://nam04.safelinks.protection.outlook.com/?url=https%3A%2F%2Feur04.safelinks.protection.outlook.com%2F%3Furl%3Dhttp%253A%252F%252Finboxpros.com%252F%26data%3D02%257C01%257C%257C53714943d1584ad059f608d675a30dd2%257C84df9e7fe9f640afb435aaaaaaaaaaaa%257C1%257C0%257C636825740500389841%26sdata%3D0CUuhsWHM7eM%252F9qEynkzhkK2aj5Hf%252F5wdFxgw3cUCOY%253D%26reserved%3D0&data=02%7C01%7C%7Cad80133303de41b7bb4d08d6764fe350%7C84df9e7fe9f640afb435aaaaaaaaaaaa%7C1%7C0%7C636826482819104905&sdata=8YNrDyjATBkZdmjjj6wcoryd%2BuModHsfoOiTg6G56Fw%3D&reserved=0> > > > <https://nam04.safelinks.protection.outlook.com/?url=https%3A%2F%2Feur04.safelinks.protection.outlook.com%2F%3Furl%3Dhttp%253A%252F%252Finboxpros.com%252F%26data%3D02%257C01%257C%257C53714943d1584ad059f608d675a30dd2%257C84df9e7fe9f640afb435aaaaaaaaaaaa%257C1%257C0%257C636825740500389841%26sdata%3D0CUuhsWHM7eM%252F9qEynkzhkK2aj5Hf%252F5wdFxgw3cUCOY%253D%26reserved%3D0&data=02%7C01%7C%7Cad80133303de41b7bb4d08d6764fe350%7C84df9e7fe9f640afb435aaaaaaaaaaaa%7C1%7C0%7C636826482819104905&sdata=8YNrDyjATBkZdmjjj6wcoryd%2BuModHsfoOiTg6G56Fw%3D&reserved=0> > > On Tue, Jan 8, 2019 at 9:19 AM T Nguyen via dmarc-discuss < > *dmarc-discuss@dmarc.org*> wrote: > <https://nam04.safelinks.protection.outlook.com/?url=https%3A%2F%2Feur04.safelinks.protection.outlook.com%2F%3Furl%3Dhttp%253A%252F%252Finboxpros.com%252F%26data%3D02%257C01%257C%257C53714943d1584ad059f608d675a30dd2%257C84df9e7fe9f640afb435aaaaaaaaaaaa%257C1%257C0%257C636825740500389841%26sdata%3D0CUuhsWHM7eM%252F9qEynkzhkK2aj5Hf%252F5wdFxgw3cUCOY%253D%26reserved%3D0&data=02%7C01%7C%7Cad80133303de41b7bb4d08d6764fe350%7C84df9e7fe9f640afb435aaaaaaaaaaaa%7C1%7C0%7C636826482819104905&sdata=8YNrDyjATBkZdmjjj6wcoryd%2BuModHsfoOiTg6G56Fw%3D&reserved=0> > > Hi Dmarc colleague, > <https://nam04.safelinks.protection.outlook.com/?url=https%3A%2F%2Feur04.safelinks.protection.outlook.com%2F%3Furl%3Dhttp%253A%252F%252Finboxpros.com%252F%26data%3D02%257C01%257C%257C53714943d1584ad059f608d675a30dd2%257C84df9e7fe9f640afb435aaaaaaaaaaaa%257C1%257C0%257C636825740500389841%26sdata%3D0CUuhsWHM7eM%252F9qEynkzhkK2aj5Hf%252F5wdFxgw3cUCOY%253D%26reserved%3D0&data=02%7C01%7C%7Cad80133303de41b7bb4d08d6764fe350%7C84df9e7fe9f640afb435aaaaaaaaaaaa%7C1%7C0%7C636826482819104905&sdata=8YNrDyjATBkZdmjjj6wcoryd%2BuModHsfoOiTg6G56Fw%3D&reserved=0> > > > <https://nam04.safelinks.protection.outlook.com/?url=https%3A%2F%2Feur04.safelinks.protection.outlook.com%2F%3Furl%3Dhttp%253A%252F%252Finboxpros.com%252F%26data%3D02%257C01%257C%257C53714943d1584ad059f608d675a30dd2%257C84df9e7fe9f640afb435aaaaaaaaaaaa%257C1%257C0%257C636825740500389841%26sdata%3D0CUuhsWHM7eM%252F9qEynkzhkK2aj5Hf%252F5wdFxgw3cUCOY%253D%26reserved%3D0&data=02%7C01%7C%7Cad80133303de41b7bb4d08d6764fe350%7C84df9e7fe9f640afb435aaaaaaaaaaaa%7C1%7C0%7C636826482819104905&sdata=8YNrDyjATBkZdmjjj6wcoryd%2BuModHsfoOiTg6G56Fw%3D&reserved=0> > > Pls help explain the tags below from the aggregate reports. The scenario > is as following: > <https://nam04.safelinks.protection.outlook.com/?url=https%3A%2F%2Feur04.safelinks.protection.outlook.com%2F%3Furl%3Dhttp%253A%252F%252Finboxpros.com%252F%26data%3D02%257C01%257C%257C53714943d1584ad059f608d675a30dd2%257C84df9e7fe9f640afb435aaaaaaaaaaaa%257C1%257C0%257C636825740500389841%26sdata%3D0CUuhsWHM7eM%252F9qEynkzhkK2aj5Hf%252F5wdFxgw3cUCOY%253D%26reserved%3D0&data=02%7C01%7C%7Cad80133303de41b7bb4d08d6764fe350%7C84df9e7fe9f640afb435aaaaaaaaaaaa%7C1%7C0%7C636826482819104905&sdata=8YNrDyjATBkZdmjjj6wcoryd%2BuModHsfoOiTg6G56Fw%3D&reserved=0> > > > <https://nam04.safelinks.protection.outlook.com/?url=https%3A%2F%2Feur04.safelinks.protection.outlook.com%2F%3Furl%3Dhttp%253A%252F%252Finboxpros.com%252F%26data%3D02%257C01%257C%257C53714943d1584ad059f608d675a30dd2%257C84df9e7fe9f640afb435aaaaaaaaaaaa%257C1%257C0%257C636825740500389841%26sdata%3D0CUuhsWHM7eM%252F9qEynkzhkK2aj5Hf%252F5wdFxgw3cUCOY%253D%26reserved%3D0&data=02%7C01%7C%7Cad80133303de41b7bb4d08d6764fe350%7C84df9e7fe9f640afb435aaaaaaaaaaaa%7C1%7C0%7C636826482819104905&sdata=8YNrDyjATBkZdmjjj6wcoryd%2BuModHsfoOiTg6G56Fw%3D&reserved=0> > > *abc.com* (main domain with dmarc record) > <https://nam04.safelinks.protection.outlook.com/?url=https%3A%2F%2Feur04.safelinks.protection.outlook.com%2F%3Furl%3Dhttp%253A%252F%252Finboxpros.com%252F%26data%3D02%257C01%257C%257C53714943d1584ad059f608d675a30dd2%257C84df9e7fe9f640afb435aaaaaaaaaaaa%257C1%257C0%257C636825740500389841%26sdata%3D0CUuhsWHM7eM%252F9qEynkzhkK2aj5Hf%252F5wdFxgw3cUCOY%253D%26reserved%3D0&data=02%7C01%7C%7Cad80133303de41b7bb4d08d6764fe350%7C84df9e7fe9f640afb435aaaaaaaaaaaa%7C1%7C0%7C636826482819104905&sdata=8YNrDyjATBkZdmjjj6wcoryd%2BuModHsfoOiTg6G56Fw%3D&reserved=0> > > *xyz.abc.com* (subdomain of *abc.com* with no dmarc record) only has spf > record including *ESP.com*(111.222.333.444) > <https://nam04.safelinks.protection.outlook.com/?url=https%3A%2F%2Feur04.safelinks.protection.outlook.com%2F%3Furl%3Dhttp%253A%252F%252Finboxpros.com%252F%26data%3D02%257C01%257C%257C53714943d1584ad059f608d675a30dd2%257C84df9e7fe9f640afb435aaaaaaaaaaaa%257C1%257C0%257C636825740500389841%26sdata%3D0CUuhsWHM7eM%252F9qEynkzhkK2aj5Hf%252F5wdFxgw3cUCOY%253D%26reserved%3D0&data=02%7C01%7C%7Cad80133303de41b7bb4d08d6764fe350%7C84df9e7fe9f640afb435aaaaaaaaaaaa%7C1%7C0%7C636826482819104905&sdata=8YNrDyjATBkZdmjjj6wcoryd%2BuModHsfoOiTg6G56Fw%3D&reserved=0> > > Questions: > <https://nam04.safelinks.protection.outlook.com/?url=https%3A%2F%2Feur04.safelinks.protection.outlook.com%2F%3Furl%3Dhttp%253A%252F%252Finboxpros.com%252F%26data%3D02%257C01%257C%257C53714943d1584ad059f608d675a30dd2%257C84df9e7fe9f640afb435aaaaaaaaaaaa%257C1%257C0%257C636825740500389841%26sdata%3D0CUuhsWHM7eM%252F9qEynkzhkK2aj5Hf%252F5wdFxgw3cUCOY%253D%26reserved%3D0&data=02%7C01%7C%7Cad80133303de41b7bb4d08d6764fe350%7C84df9e7fe9f640afb435aaaaaaaaaaaa%7C1%7C0%7C636826482819261146&sdata=ot12MAuX7Koay0OsHqgOGf5JmP3uCpeZl%2B8v74sEZQA%3D&reserved=0> > > 1. count tag ( # of same sender IP in the 24 hrs cycle? ) > <https://nam04.safelinks.protection.outlook.com/?url=https%3A%2F%2Feur04.safelinks.protection.outlook.com%2F%3Furl%3Dhttp%253A%252F%252Finboxpros.com%252F%26data%3D02%257C01%257C%257C53714943d1584ad059f608d675a30dd2%257C84df9e7fe9f640afb435aaaaaaaaaaaa%257C1%257C0%257C636825740500389841%26sdata%3D0CUuhsWHM7eM%252F9qEynkzhkK2aj5Hf%252F5wdFxgw3cUCOY%253D%26reserved%3D0&data=02%7C01%7C%7Cad80133303de41b7bb4d08d6764fe350%7C84df9e7fe9f640afb435aaaaaaaaaaaa%7C1%7C0%7C636826482819261146&sdata=ot12MAuX7Koay0OsHqgOGf5JmP3uCpeZl%2B8v74sEZQA%3D&reserved=0> > > 2. Is Identifier (header_from) tag always pointing to main domain in this > case *abc.com*. > <https://nam04.safelinks.protection.outlook.com/?url=https%3A%2F%2Feur04.safelinks.protection.outlook.com%2F%3Furl%3Dhttp%253A%252F%252Finboxpros.com%252F%26data%3D02%257C01%257C%257C53714943d1584ad059f608d675a30dd2%257C84df9e7fe9f640afb435aaaaaaaaaaaa%257C1%257C0%257C636825740500389841%26sdata%3D0CUuhsWHM7eM%252F9qEynkzhkK2aj5Hf%252F5wdFxgw3cUCOY%253D%26reserved%3D0&data=02%7C01%7C%7Cad80133303de41b7bb4d08d6764fe350%7C84df9e7fe9f640afb435aaaaaaaaaaaa%7C1%7C0%7C636826482819261146&sdata=ot12MAuX7Koay0OsHqgOGf5JmP3uCpeZl%2B8v74sEZQA%3D&reserved=0> > > 3. The scope tag "mfrom" in the auth section tag is it pointing to user > display domain? In this scenario *xyz.abc.com* that passes the spf? > <https://nam04.safelinks.protection.outlook.com/?url=https%3A%2F%2Feur04.safelinks.protection.outlook.com%2F%3Furl%3Dhttp%253A%252F%252Finboxpros.com%252F%26data%3D02%257C01%257C%257C53714943d1584ad059f608d675a30dd2%257C84df9e7fe9f640afb435aaaaaaaaaaaa%257C1%257C0%257C636825740500389841%26sdata%3D0CUuhsWHM7eM%252F9qEynkzhkK2aj5Hf%252F5wdFxgw3cUCOY%253D%26reserved%3D0&data=02%7C01%7C%7Cad80133303de41b7bb4d08d6764fe350%7C84df9e7fe9f640afb435aaaaaaaaaaaa%7C1%7C0%7C636826482819261146&sdata=ot12MAuX7Koay0OsHqgOGf5JmP3uCpeZl%2B8v74sEZQA%3D&reserved=0> > > > <https://nam04.safelinks.protection.outlook.com/?url=https%3A%2F%2Feur04.safelinks.protection.outlook.com%2F%3Furl%3Dhttp%253A%252F%252Finboxpros.com%252F%26data%3D02%257C01%257C%257C53714943d1584ad059f608d675a30dd2%257C84df9e7fe9f640afb435aaaaaaaaaaaa%257C1%257C0%257C636825740500389841%26sdata%3D0CUuhsWHM7eM%252F9qEynkzhkK2aj5Hf%252F5wdFxgw3cUCOY%253D%26reserved%3D0&data=02%7C01%7C%7Cad80133303de41b7bb4d08d6764fe350%7C84df9e7fe9f640afb435aaaaaaaaaaaa%7C1%7C0%7C636826482819261146&sdata=ot12MAuX7Koay0OsHqgOGf5JmP3uCpeZl%2B8v74sEZQA%3D&reserved=0> > > Appreciate your prompt response as always. We need to understand the > dmarc reports to start moving to p=quarantine and hopefully to reject soon. > <https://nam04.safelinks.protection.outlook.com/?url=https%3A%2F%2Feur04.safelinks.protection.outlook.com%2F%3Furl%3Dhttp%253A%252F%252Finboxpros.com%252F%26data%3D02%257C01%257C%257C53714943d1584ad059f608d675a30dd2%257C84df9e7fe9f640afb435aaaaaaaaaaaa%257C1%257C0%257C636825740500389841%26sdata%3D0CUuhsWHM7eM%252F9qEynkzhkK2aj5Hf%252F5wdFxgw3cUCOY%253D%26reserved%3D0&data=02%7C01%7C%7Cad80133303de41b7bb4d08d6764fe350%7C84df9e7fe9f640afb435aaaaaaaaaaaa%7C1%7C0%7C636826482819261146&sdata=ot12MAuX7Koay0OsHqgOGf5JmP3uCpeZl%2B8v74sEZQA%3D&reserved=0> > > > <https://nam04.safelinks.protection.outlook.com/?url=https%3A%2F%2Feur04.safelinks.protection.outlook.com%2F%3Furl%3Dhttp%253A%252F%252Finboxpros.com%252F%26data%3D02%257C01%257C%257C53714943d1584ad059f608d675a30dd2%257C84df9e7fe9f640afb435aaaaaaaaaaaa%257C1%257C0%257C636825740500389841%26sdata%3D0CUuhsWHM7eM%252F9qEynkzhkK2aj5Hf%252F5wdFxgw3cUCOY%253D%26reserved%3D0&data=02%7C01%7C%7Cad80133303de41b7bb4d08d6764fe350%7C84df9e7fe9f640afb435aaaaaaaaaaaa%7C1%7C0%7C636826482819261146&sdata=ot12MAuX7Koay0OsHqgOGf5JmP3uCpeZl%2B8v74sEZQA%3D&reserved=0> > > > <https://nam04.safelinks.protection.outlook.com/?url=https%3A%2F%2Feur04.safelinks.protection.outlook.com%2F%3Furl%3Dhttp%253A%252F%252Finboxpros.com%252F%26data%3D02%257C01%257C%257C53714943d1584ad059f608d675a30dd2%257C84df9e7fe9f640afb435aaaaaaaaaaaa%257C1%257C0%257C636825740500389841%26sdata%3D0CUuhsWHM7eM%252F9qEynkzhkK2aj5Hf%252F5wdFxgw3cUCOY%253D%26reserved%3D0&data=02%7C01%7C%7Cad80133303de41b7bb4d08d6764fe350%7C84df9e7fe9f640afb435aaaaaaaaaaaa%7C1%7C0%7C636826482819261146&sdata=ot12MAuX7Koay0OsHqgOGf5JmP3uCpeZl%2B8v74sEZQA%3D&reserved=0> > > <record> > <https://nam04.safelinks.protection.outlook.com/?url=https%3A%2F%2Feur04.safelinks.protection.outlook.com%2F%3Furl%3Dhttp%253A%252F%252Finboxpros.com%252F%26data%3D02%257C01%257C%257C53714943d1584ad059f608d675a30dd2%257C84df9e7fe9f640afb435aaaaaaaaaaaa%257C1%257C0%257C636825740500389841%26sdata%3D0CUuhsWHM7eM%252F9qEynkzhkK2aj5Hf%252F5wdFxgw3cUCOY%253D%26reserved%3D0&data=02%7C01%7C%7Cad80133303de41b7bb4d08d6764fe350%7C84df9e7fe9f640afb435aaaaaaaaaaaa%7C1%7C0%7C636826482819261146&sdata=ot12MAuX7Koay0OsHqgOGf5JmP3uCpeZl%2B8v74sEZQA%3D&reserved=0> > > <row> > <https://nam04.safelinks.protection.outlook.com/?url=https%3A%2F%2Feur04.safelinks.protection.outlook.com%2F%3Furl%3Dhttp%253A%252F%252Finboxpros.com%252F%26data%3D02%257C01%257C%257C53714943d1584ad059f608d675a30dd2%257C84df9e7fe9f640afb435aaaaaaaaaaaa%257C1%257C0%257C636825740500389841%26sdata%3D0CUuhsWHM7eM%252F9qEynkzhkK2aj5Hf%252F5wdFxgw3cUCOY%253D%26reserved%3D0&data=02%7C01%7C%7Cad80133303de41b7bb4d08d6764fe350%7C84df9e7fe9f640afb435aaaaaaaaaaaa%7C1%7C0%7C636826482819261146&sdata=ot12MAuX7Koay0OsHqgOGf5JmP3uCpeZl%2B8v74sEZQA%3D&reserved=0> > > <source_ip>111.222.333.444</source_ip> > <https://nam04.safelinks.protection.outlook.com/?url=https%3A%2F%2Feur04.safelinks.protection.outlook.com%2F%3Furl%3Dhttp%253A%252F%252Finboxpros.com%252F%26data%3D02%257C01%257C%257C53714943d1584ad059f608d675a30dd2%257C84df9e7fe9f640afb435aaaaaaaaaaaa%257C1%257C0%257C636825740500389841%26sdata%3D0CUuhsWHM7eM%252F9qEynkzhkK2aj5Hf%252F5wdFxgw3cUCOY%253D%26reserved%3D0&data=02%7C01%7C%7Cad80133303de41b7bb4d08d6764fe350%7C84df9e7fe9f640afb435aaaaaaaaaaaa%7C1%7C0%7C636826482819261146&sdata=ot12MAuX7Koay0OsHqgOGf5JmP3uCpeZl%2B8v74sEZQA%3D&reserved=0> > > <count>5</count> > <https://nam04.safelinks.protection.outlook.com/?url=https%3A%2F%2Feur04.safelinks.protection.outlook.com%2F%3Furl%3Dhttp%253A%252F%252Finboxpros.com%252F%26data%3D02%257C01%257C%257C53714943d1584ad059f608d675a30dd2%257C84df9e7fe9f640afb435aaaaaaaaaaaa%257C1%257C0%257C636825740500389841%26sdata%3D0CUuhsWHM7eM%252F9qEynkzhkK2aj5Hf%252F5wdFxgw3cUCOY%253D%26reserved%3D0&data=02%7C01%7C%7Cad80133303de41b7bb4d08d6764fe350%7C84df9e7fe9f640afb435aaaaaaaaaaaa%7C1%7C0%7C636826482819261146&sdata=ot12MAuX7Koay0OsHqgOGf5JmP3uCpeZl%2B8v74sEZQA%3D&reserved=0> > > <policy_evaluated> > <https://nam04.safelinks.protection.outlook.com/?url=https%3A%2F%2Feur04.safelinks.protection.outlook.com%2F%3Furl%3Dhttp%253A%252F%252Finboxpros.com%252F%26data%3D02%257C01%257C%257C53714943d1584ad059f608d675a30dd2%257C84df9e7fe9f640afb435aaaaaaaaaaaa%257C1%257C0%257C636825740500389841%26sdata%3D0CUuhsWHM7eM%252F9qEynkzhkK2aj5Hf%252F5wdFxgw3cUCOY%253D%26reserved%3D0&data=02%7C01%7C%7Cad80133303de41b7bb4d08d6764fe350%7C84df9e7fe9f640afb435aaaaaaaaaaaa%7C1%7C0%7C636826482819261146&sdata=ot12MAuX7Koay0OsHqgOGf5JmP3uCpeZl%2B8v74sEZQA%3D&reserved=0> > > <disposition>none</disposition> > <https://nam04.safelinks.protection.outlook.com/?url=https%3A%2F%2Feur04.safelinks.protection.outlook.com%2F%3Furl%3Dhttp%253A%252F%252Finboxpros.com%252F%26data%3D02%257C01%257C%257C53714943d1584ad059f608d675a30dd2%257C84df9e7fe9f640afb435aaaaaaaaaaaa%257C1%257C0%257C636825740500389841%26sdata%3D0CUuhsWHM7eM%252F9qEynkzhkK2aj5Hf%252F5wdFxgw3cUCOY%253D%26reserved%3D0&data=02%7C01%7C%7Cad80133303de41b7bb4d08d6764fe350%7C84df9e7fe9f640afb435aaaaaaaaaaaa%7C1%7C0%7C636826482819261146&sdata=ot12MAuX7Koay0OsHqgOGf5JmP3uCpeZl%2B8v74sEZQA%3D&reserved=0> > > <dkim>fail</dkim> > <https://nam04.safelinks.protection.outlook.com/?url=https%3A%2F%2Feur04.safelinks.protection.outlook.com%2F%3Furl%3Dhttp%253A%252F%252Finboxpros.com%252F%26data%3D02%257C01%257C%257C53714943d1584ad059f608d675a30dd2%257C84df9e7fe9f640afb435aaaaaaaaaaaa%257C1%257C0%257C636825740500389841%26sdata%3D0CUuhsWHM7eM%252F9qEynkzhkK2aj5Hf%252F5wdFxgw3cUCOY%253D%26reserved%3D0&data=02%7C01%7C%7Cad80133303de41b7bb4d08d6764fe350%7C84df9e7fe9f640afb435aaaaaaaaaaaa%7C1%7C0%7C636826482819417400&sdata=jfvtkDOgzLhcA6Xmz7d4rpV3qmsK5luf0LjTXoXSm%2FY%3D&reserved=0> > > <spf>fail</spf> > <https://nam04.safelinks.protection.outlook.com/?url=https%3A%2F%2Feur04.safelinks.protection.outlook.com%2F%3Furl%3Dhttp%253A%252F%252Finboxpros.com%252F%26data%3D02%257C01%257C%257C53714943d1584ad059f608d675a30dd2%257C84df9e7fe9f640afb435aaaaaaaaaaaa%257C1%257C0%257C636825740500389841%26sdata%3D0CUuhsWHM7eM%252F9qEynkzhkK2aj5Hf%252F5wdFxgw3cUCOY%253D%26reserved%3D0&data=02%7C01%7C%7Cad80133303de41b7bb4d08d6764fe350%7C84df9e7fe9f640afb435aaaaaaaaaaaa%7C1%7C0%7C636826482819417400&sdata=jfvtkDOgzLhcA6Xmz7d4rpV3qmsK5luf0LjTXoXSm%2FY%3D&reserved=0> > > </policy_evaluated> > <https://nam04.safelinks.protection.outlook.com/?url=https%3A%2F%2Feur04.safelinks.protection.outlook.com%2F%3Furl%3Dhttp%253A%252F%252Finboxpros.com%252F%26data%3D02%257C01%257C%257C53714943d1584ad059f608d675a30dd2%257C84df9e7fe9f640afb435aaaaaaaaaaaa%257C1%257C0%257C636825740500389841%26sdata%3D0CUuhsWHM7eM%252F9qEynkzhkK2aj5Hf%252F5wdFxgw3cUCOY%253D%26reserved%3D0&data=02%7C01%7C%7Cad80133303de41b7bb4d08d6764fe350%7C84df9e7fe9f640afb435aaaaaaaaaaaa%7C1%7C0%7C636826482819417400&sdata=jfvtkDOgzLhcA6Xmz7d4rpV3qmsK5luf0LjTXoXSm%2FY%3D&reserved=0> > > </row> > <https://nam04.safelinks.protection.outlook.com/?url=https%3A%2F%2Feur04.safelinks.protection.outlook.com%2F%3Furl%3Dhttp%253A%252F%252Finboxpros.com%252F%26data%3D02%257C01%257C%257C53714943d1584ad059f608d675a30dd2%257C84df9e7fe9f640afb435aaaaaaaaaaaa%257C1%257C0%257C636825740500389841%26sdata%3D0CUuhsWHM7eM%252F9qEynkzhkK2aj5Hf%252F5wdFxgw3cUCOY%253D%26reserved%3D0&data=02%7C01%7C%7Cad80133303de41b7bb4d08d6764fe350%7C84df9e7fe9f640afb435aaaaaaaaaaaa%7C1%7C0%7C636826482819417400&sdata=jfvtkDOgzLhcA6Xmz7d4rpV3qmsK5luf0LjTXoXSm%2FY%3D&reserved=0> > > <identifiers> > <https://nam04.safelinks.protection.outlook.com/?url=https%3A%2F%2Feur04.safelinks.protection.outlook.com%2F%3Furl%3Dhttp%253A%252F%252Finboxpros.com%252F%26data%3D02%257C01%257C%257C53714943d1584ad059f608d675a30dd2%257C84df9e7fe9f640afb435aaaaaaaaaaaa%257C1%257C0%257C636825740500389841%26sdata%3D0CUuhsWHM7eM%252F9qEynkzhkK2aj5Hf%252F5wdFxgw3cUCOY%253D%26reserved%3D0&data=02%7C01%7C%7Cad80133303de41b7bb4d08d6764fe350%7C84df9e7fe9f640afb435aaaaaaaaaaaa%7C1%7C0%7C636826482819417400&sdata=jfvtkDOgzLhcA6Xmz7d4rpV3qmsK5luf0LjTXoXSm%2FY%3D&reserved=0> > > <header_from>*abc.com*</header_from> > <https://nam04.safelinks.protection.outlook.com/?url=https%3A%2F%2Feur04.safelinks.protection.outlook.com%2F%3Furl%3Dhttp%253A%252F%252Finboxpros.com%252F%26data%3D02%257C01%257C%257C53714943d1584ad059f608d675a30dd2%257C84df9e7fe9f640afb435aaaaaaaaaaaa%257C1%257C0%257C636825740500389841%26sdata%3D0CUuhsWHM7eM%252F9qEynkzhkK2aj5Hf%252F5wdFxgw3cUCOY%253D%26reserved%3D0&data=02%7C01%7C%7Cad80133303de41b7bb4d08d6764fe350%7C84df9e7fe9f640afb435aaaaaaaaaaaa%7C1%7C0%7C636826482819417400&sdata=jfvtkDOgzLhcA6Xmz7d4rpV3qmsK5luf0LjTXoXSm%2FY%3D&reserved=0> > > </identifiers> > <https://nam04.safelinks.protection.outlook.com/?url=https%3A%2F%2Feur04.safelinks.protection.outlook.com%2F%3Furl%3Dhttp%253A%252F%252Finboxpros.com%252F%26data%3D02%257C01%257C%257C53714943d1584ad059f608d675a30dd2%257C84df9e7fe9f640afb435aaaaaaaaaaaa%257C1%257C0%257C636825740500389841%26sdata%3D0CUuhsWHM7eM%252F9qEynkzhkK2aj5Hf%252F5wdFxgw3cUCOY%253D%26reserved%3D0&data=02%7C01%7C%7Cad80133303de41b7bb4d08d6764fe350%7C84df9e7fe9f640afb435aaaaaaaaaaaa%7C1%7C0%7C636826482819417400&sdata=jfvtkDOgzLhcA6Xmz7d4rpV3qmsK5luf0LjTXoXSm%2FY%3D&reserved=0> > > <auth_results> > <https://nam04.safelinks.protection.outlook.com/?url=https%3A%2F%2Feur04.safelinks.protection.outlook.com%2F%3Furl%3Dhttp%253A%252F%252Finboxpros.com%252F%26data%3D02%257C01%257C%257C53714943d1584ad059f608d675a30dd2%257C84df9e7fe9f640afb435aaaaaaaaaaaa%257C1%257C0%257C636825740500389841%26sdata%3D0CUuhsWHM7eM%252F9qEynkzhkK2aj5Hf%252F5wdFxgw3cUCOY%253D%26reserved%3D0&data=02%7C01%7C%7Cad80133303de41b7bb4d08d6764fe350%7C84df9e7fe9f640afb435aaaaaaaaaaaa%7C1%7C0%7C636826482819417400&sdata=jfvtkDOgzLhcA6Xmz7d4rpV3qmsK5luf0LjTXoXSm%2FY%3D&reserved=0> > > > <https://nam04.safelinks.protection.outlook.com/?url=https%3A%2F%2Feur04.safelinks.protection.outlook.com%2F%3Furl%3Dhttp%253A%252F%252Finboxpros.com%252F%26data%3D02%257C01%257C%257C53714943d1584ad059f608d675a30dd2%257C84df9e7fe9f640afb435aaaaaaaaaaaa%257C1%257C0%257C636825740500389841%26sdata%3D0CUuhsWHM7eM%252F9qEynkzhkK2aj5Hf%252F5wdFxgw3cUCOY%253D%26reserved%3D0&data=02%7C01%7C%7Cad80133303de41b7bb4d08d6764fe350%7C84df9e7fe9f640afb435aaaaaaaaaaaa%7C1%7C0%7C636826482819417400&sdata=jfvtkDOgzLhcA6Xmz7d4rpV3qmsK5luf0LjTXoXSm%2FY%3D&reserved=0> > > <spf> > <https://nam04.safelinks.protection.outlook.com/?url=https%3A%2F%2Feur04.safelinks.protection.outlook.com%2F%3Furl%3Dhttp%253A%252F%252Finboxpros.com%252F%26data%3D02%257C01%257C%257C53714943d1584ad059f608d675a30dd2%257C84df9e7fe9f640afb435aaaaaaaaaaaa%257C1%257C0%257C636825740500389841%26sdata%3D0CUuhsWHM7eM%252F9qEynkzhkK2aj5Hf%252F5wdFxgw3cUCOY%253D%26reserved%3D0&data=02%7C01%7C%7Cad80133303de41b7bb4d08d6764fe350%7C84df9e7fe9f640afb435aaaaaaaaaaaa%7C1%7C0%7C636826482819417400&sdata=jfvtkDOgzLhcA6Xmz7d4rpV3qmsK5luf0LjTXoXSm%2FY%3D&reserved=0> > > <domain>*ESP.com*</domain> > <https://nam04.safelinks.protection.outlook.com/?url=https%3A%2F%2Feur04.safelinks.protection.outlook.com%2F%3Furl%3Dhttp%253A%252F%252Finboxpros.com%252F%26data%3D02%257C01%257C%257C53714943d1584ad059f608d675a30dd2%257C84df9e7fe9f640afb435aaaaaaaaaaaa%257C1%257C0%257C636825740500389841%26sdata%3D0CUuhsWHM7eM%252F9qEynkzhkK2aj5Hf%252F5wdFxgw3cUCOY%253D%26reserved%3D0&data=02%7C01%7C%7Cad80133303de41b7bb4d08d6764fe350%7C84df9e7fe9f640afb435aaaaaaaaaaaa%7C1%7C0%7C636826482819417400&sdata=jfvtkDOgzLhcA6Xmz7d4rpV3qmsK5luf0LjTXoXSm%2FY%3D&reserved=0> > > <scope>mfrom</scope> > <https://nam04.safelinks.protection.outlook.com/?url=https%3A%2F%2Feur04.safelinks.protection.outlook.com%2F%3Furl%3Dhttp%253A%252F%252Finboxpros.com%252F%26data%3D02%257C01%257C%257C53714943d1584ad059f608d675a30dd2%257C84df9e7fe9f640afb435aaaaaaaaaaaa%257C1%257C0%257C636825740500389841%26sdata%3D0CUuhsWHM7eM%252F9qEynkzhkK2aj5Hf%252F5wdFxgw3cUCOY%253D%26reserved%3D0&data=02%7C01%7C%7Cad80133303de41b7bb4d08d6764fe350%7C84df9e7fe9f640afb435aaaaaaaaaaaa%7C1%7C0%7C636826482819417400&sdata=jfvtkDOgzLhcA6Xmz7d4rpV3qmsK5luf0LjTXoXSm%2FY%3D&reserved=0> > > <result>pass</result> > <https://nam04.safelinks.protection.outlook.com/?url=https%3A%2F%2Feur04.safelinks.protection.outlook.com%2F%3Furl%3Dhttp%253A%252F%252Finboxpros.com%252F%26data%3D02%257C01%257C%257C53714943d1584ad059f608d675a30dd2%257C84df9e7fe9f640afb435aaaaaaaaaaaa%257C1%257C0%257C636825740500389841%26sdata%3D0CUuhsWHM7eM%252F9qEynkzhkK2aj5Hf%252F5wdFxgw3cUCOY%253D%26reserved%3D0&data=02%7C01%7C%7Cad80133303de41b7bb4d08d6764fe350%7C84df9e7fe9f640afb435aaaaaaaaaaaa%7C1%7C0%7C636826482819417400&sdata=jfvtkDOgzLhcA6Xmz7d4rpV3qmsK5luf0LjTXoXSm%2FY%3D&reserved=0> > > </spf> > <https://nam04.safelinks.protection.outlook.com/?url=https%3A%2F%2Feur04.safelinks.protection.outlook.com%2F%3Furl%3Dhttp%253A%252F%252Finboxpros.com%252F%26data%3D02%257C01%257C%257C53714943d1584ad059f608d675a30dd2%257C84df9e7fe9f640afb435aaaaaaaaaaaa%257C1%257C0%257C636825740500389841%26sdata%3D0CUuhsWHM7eM%252F9qEynkzhkK2aj5Hf%252F5wdFxgw3cUCOY%253D%26reserved%3D0&data=02%7C01%7C%7Cad80133303de41b7bb4d08d6764fe350%7C84df9e7fe9f640afb435aaaaaaaaaaaa%7C1%7C0%7C636826482819417400&sdata=jfvtkDOgzLhcA6Xmz7d4rpV3qmsK5luf0LjTXoXSm%2FY%3D&reserved=0> > > </auth_results> > <https://nam04.safelinks.protection.outlook.com/?url=https%3A%2F%2Feur04.safelinks.protection.outlook.com%2F%3Furl%3Dhttp%253A%252F%252Finboxpros.com%252F%26data%3D02%257C01%257C%257C53714943d1584ad059f608d675a30dd2%257C84df9e7fe9f640afb435aaaaaaaaaaaa%257C1%257C0%257C636825740500389841%26sdata%3D0CUuhsWHM7eM%252F9qEynkzhkK2aj5Hf%252F5wdFxgw3cUCOY%253D%26reserved%3D0&data=02%7C01%7C%7Cad80133303de41b7bb4d08d6764fe350%7C84df9e7fe9f640afb435aaaaaaaaaaaa%7C1%7C0%7C636826482819573660&sdata=7KaPzKV9B%2FJmKycPC7dKAvIjWmZMfk1eRXhHrQnCOxs%3D&reserved=0> > > </record> > <https://nam04.safelinks.protection.outlook.com/?url=https%3A%2F%2Feur04.safelinks.protection.outlook.com%2F%3Furl%3Dhttp%253A%252F%252Finboxpros.com%252F%26data%3D02%257C01%257C%257C53714943d1584ad059f608d675a30dd2%257C84df9e7fe9f640afb435aaaaaaaaaaaa%257C1%257C0%257C636825740500389841%26sdata%3D0CUuhsWHM7eM%252F9qEynkzhkK2aj5Hf%252F5wdFxgw3cUCOY%253D%26reserved%3D0&data=02%7C01%7C%7Cad80133303de41b7bb4d08d6764fe350%7C84df9e7fe9f640afb435aaaaaaaaaaaa%7C1%7C0%7C636826482819573660&sdata=7KaPzKV9B%2FJmKycPC7dKAvIjWmZMfk1eRXhHrQnCOxs%3D&reserved=0> > > > <https://nam04.safelinks.protection.outlook.com/?url=https%3A%2F%2Feur04.safelinks.protection.outlook.com%2F%3Furl%3Dhttp%253A%252F%252Finboxpros.com%252F%26data%3D02%257C01%257C%257C53714943d1584ad059f608d675a30dd2%257C84df9e7fe9f640afb435aaaaaaaaaaaa%257C1%257C0%257C636825740500389841%26sdata%3D0CUuhsWHM7eM%252F9qEynkzhkK2aj5Hf%252F5wdFxgw3cUCOY%253D%26reserved%3D0&data=02%7C01%7C%7Cad80133303de41b7bb4d08d6764fe350%7C84df9e7fe9f640afb435aaaaaaaaaaaa%7C1%7C0%7C636826482819573660&sdata=7KaPzKV9B%2FJmKycPC7dKAvIjWmZMfk1eRXhHrQnCOxs%3D&reserved=0> > > _______________________________________________ > dmarc-discuss mailing list > *dmarc-discuss@dmarc.org* > *http://www.dmarc.org/mailman/listinfo/dmarc-discuss* > > NOTE: Participating in this list means you agree to the DMARC Note Well > terms (*http://www.dmarc.org/note_well.html*) > <https://nam04.safelinks.protection.outlook.com/?url=https%3A%2F%2Feur04.safelinks.protection.outlook.com%2F%3Furl%3Dhttp%253A%252F%252Finboxpros.com%252F%26data%3D02%257C01%257C%257C53714943d1584ad059f608d675a30dd2%257C84df9e7fe9f640afb435aaaaaaaaaaaa%257C1%257C0%257C636825740500389841%26sdata%3D0CUuhsWHM7eM%252F9qEynkzhkK2aj5Hf%252F5wdFxgw3cUCOY%253D%26reserved%3D0&data=02%7C01%7C%7Cad80133303de41b7bb4d08d6764fe350%7C84df9e7fe9f640afb435aaaaaaaaaaaa%7C1%7C0%7C636826482819573660&sdata=7KaPzKV9B%2FJmKycPC7dKAvIjWmZMfk1eRXhHrQnCOxs%3D&reserved=0> > > _______________________________________________ > dmarc-discuss mailing list > *dmarc-discuss@dmarc.org* > *http://www.dmarc.org/mailman/listinfo/dmarc-discuss* > > NOTE: Participating in this list means you agree to the DMARC Note Well > terms (*http://www.dmarc.org/note_well.html*) > <https://nam04.safelinks.protection.outlook.com/?url=https%3A%2F%2Feur04.safelinks.protection.outlook.com%2F%3Furl%3Dhttp%253A%252F%252Finboxpros.com%252F%26data%3D02%257C01%257C%257C53714943d1584ad059f608d675a30dd2%257C84df9e7fe9f640afb435aaaaaaaaaaaa%257C1%257C0%257C636825740500389841%26sdata%3D0CUuhsWHM7eM%252F9qEynkzhkK2aj5Hf%252F5wdFxgw3cUCOY%253D%26reserved%3D0&data=02%7C01%7C%7Cad80133303de41b7bb4d08d6764fe350%7C84df9e7fe9f640afb435aaaaaaaaaaaa%7C1%7C0%7C636826482819573660&sdata=7KaPzKV9B%2FJmKycPC7dKAvIjWmZMfk1eRXhHrQnCOxs%3D&reserved=0> > > > > <https://nam04.safelinks.protection.outlook.com/?url=https%3A%2F%2Feur04.safelinks.protection.outlook.com%2F%3Furl%3Dhttp%253A%252F%252Finboxpros.com%252F%26data%3D02%257C01%257C%257C53714943d1584ad059f608d675a30dd2%257C84df9e7fe9f640afb435aaaaaaaaaaaa%257C1%257C0%257C636825740500389841%26sdata%3D0CUuhsWHM7eM%252F9qEynkzhkK2aj5Hf%252F5wdFxgw3cUCOY%253D%26reserved%3D0&data=02%7C01%7C%7Cad80133303de41b7bb4d08d6764fe350%7C84df9e7fe9f640afb435aaaaaaaaaaaa%7C1%7C0%7C636826482819573660&sdata=7KaPzKV9B%2FJmKycPC7dKAvIjWmZMfk1eRXhHrQnCOxs%3D&reserved=0> > > > <https://nam04.safelinks.protection.outlook.com/?url=https%3A%2F%2Feur04.safelinks.protection.outlook.com%2F%3Furl%3Dhttp%253A%252F%252Finboxpros.com%252F%26data%3D02%257C01%257C%257C53714943d1584ad059f608d675a30dd2%257C84df9e7fe9f640afb435aaaaaaaaaaaa%257C1%257C0%257C636825740500389841%26sdata%3D0CUuhsWHM7eM%252F9qEynkzhkK2aj5Hf%252F5wdFxgw3cUCOY%253D%26reserved%3D0&data=02%7C01%7C%7Cad80133303de41b7bb4d08d6764fe350%7C84df9e7fe9f640afb435aaaaaaaaaaaa%7C1%7C0%7C636826482819573660&sdata=7KaPzKV9B%2FJmKycPC7dKAvIjWmZMfk1eRXhHrQnCOxs%3D&reserved=0> > > -- > <https://nam04.safelinks.protection.outlook.com/?url=https%3A%2F%2Feur04.safelinks.protection.outlook.com%2F%3Furl%3Dhttp%253A%252F%252Finboxpros.com%252F%26data%3D02%257C01%257C%257C53714943d1584ad059f608d675a30dd2%257C84df9e7fe9f640afb435aaaaaaaaaaaa%257C1%257C0%257C636825740500389841%26sdata%3D0CUuhsWHM7eM%252F9qEynkzhkK2aj5Hf%252F5wdFxgw3cUCOY%253D%26reserved%3D0&data=02%7C01%7C%7Cad80133303de41b7bb4d08d6764fe350%7C84df9e7fe9f640afb435aaaaaaaaaaaa%7C1%7C0%7C636826482819573660&sdata=7KaPzKV9B%2FJmKycPC7dKAvIjWmZMfk1eRXhHrQnCOxs%3D&reserved=0> > > *PAUL ROCK > <https://nam04.safelinks.protection.outlook.com/?url=https%3A%2F%2Feur04.safelinks.protection.outlook.com%2F%3Furl%3Dhttp%253A%252F%252Finboxpros.com%252F%26data%3D02%257C01%257C%257C53714943d1584ad059f608d675a30dd2%257C84df9e7fe9f640afb435aaaaaaaaaaaa%257C1%257C0%257C636825740500389841%26sdata%3D0CUuhsWHM7eM%252F9qEynkzhkK2aj5Hf%252F5wdFxgw3cUCOY%253D%26reserved%3D0&data=02%7C01%7C%7Cad80133303de41b7bb4d08d6764fe350%7C84df9e7fe9f640afb435aaaaaaaaaaaa%7C1%7C0%7C636826482819573660&sdata=7KaPzKV9B%2FJmKycPC7dKAvIjWmZMfk1eRXhHrQnCOxs%3D&reserved=0>* > > *Sr Software Dev Engineer, Mail Services, Verizon Media > <https://nam04.safelinks.protection.outlook.com/?url=https%3A%2F%2Feur04.safelinks.protection.outlook.com%2F%3Furl%3Dhttp%253A%252F%252Finboxpros.com%252F%26data%3D02%257C01%257C%257C53714943d1584ad059f608d675a30dd2%257C84df9e7fe9f640afb435aaaaaaaaaaaa%257C1%257C0%257C636825740500389841%26sdata%3D0CUuhsWHM7eM%252F9qEynkzhkK2aj5Hf%252F5wdFxgw3cUCOY%253D%26reserved%3D0&data=02%7C01%7C%7Cad80133303de41b7bb4d08d6764fe350%7C84df9e7fe9f640afb435aaaaaaaaaaaa%7C1%7C0%7C636826482819573660&sdata=7KaPzKV9B%2FJmKycPC7dKAvIjWmZMfk1eRXhHrQnCOxs%3D&reserved=0>* > > P: 703-265-5734 | C: 703-980-8380 > 22070 Broderick Dr.| Dulles, VA | 20166-9305 > <https://nam04.safelinks.protection.outlook.com/?url=https%3A%2F%2Feur04.safelinks.protection.outlook.com%2F%3Furl%3Dhttp%253A%252F%252Finboxpros.com%252F%26data%3D02%257C01%257C%257C53714943d1584ad059f608d675a30dd2%257C84df9e7fe9f640afb435aaaaaaaaaaaa%257C1%257C0%257C636825740500389841%26sdata%3D0CUuhsWHM7eM%252F9qEynkzhkK2aj5Hf%252F5wdFxgw3cUCOY%253D%26reserved%3D0&data=02%7C01%7C%7Cad80133303de41b7bb4d08d6764fe350%7C84df9e7fe9f640afb435aaaaaaaaaaaa%7C1%7C0%7C636826482819573660&sdata=7KaPzKV9B%2FJmKycPC7dKAvIjWmZMfk1eRXhHrQnCOxs%3D&reserved=0> > > > > -- > PAUL ROCK > *Sr Software Dev Engineer, Mail Services,* *Verizon Media* > P: 703-265-5734 | C: 703-980-8380 > 22070 Broderick Dr.| Dulles, VA | 20166-9305 > >
_______________________________________________ dmarc-discuss mailing list dmarc-discuss@dmarc.org http://www.dmarc.org/mailman/listinfo/dmarc-discuss NOTE: Participating in this list means you agree to the DMARC Note Well terms (http://www.dmarc.org/note_well.html)
