[dmarc-discuss] Multiple SPF results in report

Franck Martin fmartin at linkedin.com
Mon Apr 4 08:51:54 PDT 2016


It is a bug.

There can only be one SPF per record. Theoretically SPF returns 2 results,
one for the RFC7208.HELO and another one for RFC7208.MAILFROM, but DMARC
takes as input only RFC7208.MAILFROM, therefore only this results is needed
in DMARC reports.

RFC7208.MAILFROM is not RFC5321.MailFrom, there is a subtle but important
difference here.

On Mon, Apr 4, 2016 at 12:23 AM, Maarten Oelering via dmarc-discuss <
dmarc-discuss at dmarc.org> wrote:

> Do you mean that in the XML you see 6 <spf> elements in one <auth_results>
> element? Or do you mean you see 6 different <spf> domains in the your
> reports?
>
> Maarten Oelering
> Postmastery
>
> On 4 apr. 2016, at 09:05, Nick via dmarc-discuss <dmarc-discuss at dmarc.org>
> wrote:
>
> I received a DMARC report with multiple SPF results. I wonder how this is
> possible as I only have one SPF record for my domain defined. In one report
> I got 6 SPF results.
>
> The only thing I could think of is some automatic forwarding service
> changing the return path header. Are there more usecases possible how this
> can happen?
>
> Thanks
> Nick
> _______________________________________________
> dmarc-discuss mailing list
> dmarc-discuss at dmarc.org
> http://www.dmarc.org/mailman/listinfo/dmarc-discuss
>
> NOTE: Participating in this list means you agree to the DMARC Note Well
> terms (http://www.dmarc.org/note_well.html)
>
>
>
> _______________________________________________
> dmarc-discuss mailing list
> dmarc-discuss at dmarc.org
> http://www.dmarc.org/mailman/listinfo/dmarc-discuss
>
> NOTE: Participating in this list means you agree to the DMARC Note Well
> terms (http://www.dmarc.org/note_well.html)
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://dmarc.org/pipermail/dmarc-discuss/attachments/20160404/6ad5b048/attachment.html>


More information about the dmarc-discuss mailing list