Re: [dmarc-discuss] Multiple SPF results in report

2016-04-04 Thread Franck Martin via dmarc-discuss
The question, is what is the RFC5321.mailfrom is empty? The RFC7208.MAILFROM is never empty. https://tools.ietf.org/html/rfc7208#section-2.4 SPF verifiers MUST check the "MAIL FROM" identity if a "HELO" check either has not been performed or has not reached a definitive policy result by

Re: [dmarc-discuss] Multiple SPF results in report

2016-04-04 Thread Lugo, Dave via dmarc-discuss
Franck, What if the RFC7208.MAILFROM is empty? I recall some questions from colleagues re dmarc reporting and the spf scope (help or mailfrom). Thanks, Dave -- Dave Lugo Engineer, Comcast Anti-Abuse Technologies Desk: 215-286-5451 From: dmarc-discuss

Re: [dmarc-discuss] Multiple SPF results in report

2016-04-04 Thread Franck Martin via dmarc-discuss
It is a bug. There can only be one SPF per record. Theoretically SPF returns 2 results, one for the RFC7208.HELO and another one for RFC7208.MAILFROM, but DMARC takes as input only RFC7208.MAILFROM, therefore only this results is needed in DMARC reports. RFC7208.MAILFROM is not RFC5321.MailFrom,

Re: [dmarc-discuss] DMARC configuration when using spam solution in Front of O365

2016-04-04 Thread Duggan, Anita via dmarc-discuss
Have attached the results from an email that is in the DMARC mail box that we set up to track messages. We currently have set p=none as we review the mail being captured This email is from (Timzone.com) which is another O365 tenant that we own, it has SPF records but no DKIM or DMARC. All

Re: [dmarc-discuss] Multiple SPF results in report

2016-04-04 Thread Maarten Oelering via dmarc-discuss
Do you mean that in the XML you see 6 elements in one element? Or do you mean you see 6 different domains in the your reports? Maarten Oelering Postmastery > On 4 apr. 2016, at 09:05, Nick via dmarc-discuss > wrote: > > I received a DMARC report with multiple SPF

[dmarc-discuss] Multiple SPF results in report

2016-04-04 Thread Nick via dmarc-discuss
I received a DMARC report with multiple SPF results. I wonder how this is possible as I only have one SPF record for my domain defined. In one report I got 6 SPF results. The only thing I could think of is some automatic forwarding service changing the return path header. Are there more