Networkologist

Well-Known Member
Feb 5, 2003
215
2
168
One of my domains which is using Clouflares free version, every once in a while, instead of the report coming from "[email protected]" I receive:
"[email protected]" I've xxxxxx out my domain name from the xml file:


<?xml version='1.0' encoding='utf-8'?>
<feedback><report_metadata><org_name>Mail.Ru</org_name><email>[email protected]</email><extra_contact_info>Почта</extra_contact_info><report_id>13626050050518643271623974400</report_id><date_range><begin>1623974400</begin><end>1624060800</end></date_range></report_metadata><policy_published><domain>xxxxxx.com</domain><adkim>r</adkim><aspf>r</aspf><p>reject</p><sp>reject</sp><pct>100</pct></policy_published><record><row><source_ip>178.165.91.59</source_ip><count>1</count><policy_evaluated><disposition>reject</disposition><dkim>fail</dkim><spf>fail</spf></policy_evaluated></row><identifiers><header_from>xxxxxxx.com</header_from></identifiers><auth_results><spf><domain>xxxxxx.com</domain><scope>mfrom</scope><result>softfail</result></spf></auth_results></record><record><row><source_ip>196.216.71.74</source_ip><count>1</count><policy_evaluated><disposition>reject</disposition><dkim>fail</dkim><spf>fail</spf></policy_evaluated></row><identifiers><header_from>xxxxxx.com</header_from></identifiers><auth_results><spf><domain>nxxxxxxx.com</domain><scope>mfrom</scope><result>softfail</result></spf></auth_results></record></feedback>
 
Last edited by a moderator:

cPRex

Jurassic Moderator
Staff member
Oct 19, 2014
6,852
904
313
cPanel Access Level
Root Administrator
Hey there! The short answer is that someone is likely trying to spoof email from your domain and this is the notification. There are some additional details on this here:

 

Networkologist

Well-Known Member
Feb 5, 2003
215
2
168
Thanks for the reply.

My dmarc is set to reject.

At least they're being rejected. No further reports from mail.ru but I'll keep an eye on it.
 
  • Like
Reactions: cPRex