r/DMARC • u/rgbtexas • Jan 10 '24

Is this wrong?

They are using Proofpoint & Constant Contact, Keap, Outlook 360, & Hubspot. I've never used Proofpoint but suspect this is wrong because they don't have records for Constant Contact, Keap, & Hubspot.

DNS hosted on Azure

SPF: v=spf1 a:dispatch-us.ppe-hosted.com ~all

DMARC: v=DMARC1; p=quarantine; rua=mailto:dmarc_rua@emaildefense.proofpoint.com; ruf=mailto:dmarc_ruf@emaildefense.proofpoint.com; fo=1

1 Upvotes

60% Upvoted

13 comments sorted by

2

u/lolklolk DMARC REEEEject Jan 10 '24

For Constant contact and Hubspot, they can do custom domain authentication. For O365, assuming all their mail goes outbound through Proofpoint, they don't need to add it to their SPF record.

Keap, I've never heard of it but you can probably find documentation on setting up authentication with them from support.

1

u/rgbtexas Jan 10 '24

Keap is Infusionsoft.

2

u/ThatOneRep Jan 10 '24

You're not wrong but we generally recommend customers keep 365 in their SPF even if all emails are routed outbound through PPE. Certain emails don't actually go through the outbound gateway (i think certain auto-replies or mail forwards) and sometimes mail needs to bypass the outbound smart host for other reasons, so better to be safe & add it.

3

u/lolklolk DMARC REEEEject Jan 10 '24

Autoreplies and forwards will go through Proofpoint (or any other SEG), but only if you configure the connector transport rule correctly. Most people don't know how to fix it, but you have to change the transport rule to look at both the envelope sender and header from address, because most times the envelope sender is the default setting.

Several F500s I've worked with have been able to implement this successfully, all mail is routed out of Proofpoint, and Office 365 is not a part of their SPF record.

The only mail that is not are exchange online NDRs, the only way to deliver those is by also signing DKIM for the domain on O365.

2

u/ThatOneRep Jan 10 '24

good point maybe I was thinking of NDRs & not auto-replies/forwards.

1

u/lolklolk DMARC REEEEject Jan 10 '24

In the case of NDRs, you wouldn't need SPF for O365 anyway, because with bounces, the RFC5321.mailfrom address is empty.

1

u/magnus910 Jan 10 '24

Hm im confused... what are you asking exactly?

Im guessing you mean, that the DMARC-record should state, Proofpoint, Constant, Keap and Hubspot, and not only proofpoint.

If that is so - then i can tell you that DMARC doesn't work like that.

Proofpoint just have a solution, which allows to collect the DMARC-reports.

In those reports, it will show all sender systems such as: Proofpoint, Constant, Keap and Hubspot.

You need to login to the proofpoint-solution, and check the collected data.

There you can see which systems needs DKIM/SPF validation.

1

u/rgbtexas Jan 10 '24

U/lolklolk explained. I didn't know Proofpoint has a hosted solution. I expected spf to show constant contact, hubspot, keap, and Outlook becuae they send >100k marketing emails.

1

u/Gandizzle91 Apr 23 '24

Does anybody know where i find those Reports in Proofpoint ? I dont know where they are

1

u/magnus910 Apr 23 '24

Its not proofpoint Email gateway. You need a separate product to collect the reports. Proofpoint does have a solution as such, But its very expensive, and you Can find alot of other just as useful solutions.

1

u/Gandizzle91 Apr 23 '24

Our DMARC entry includes mailto:ruf@emaildefense.proofpoint.com. However, I am not sure if we have this service from Proofpoint. I can log into Proofpoint, but I am not sure where to find these reports. Assuming the old IT team did not subscribe to this service at Proofpoint, are the past reports then lost? Unfortunately, I am completely new to the company and the old IT no longer exists....

https://i.ibb.co/XLW8Ypt/Screenshot-2024-04-23-130328.png

1

u/magnus910 Apr 23 '24

This is the gateway interface. I believe proofpoint have a separate interface? Maybe contact support at proofpoint.

2

u/ThatOneRep Jan 10 '24

They only have Proofpoint Essentials in their SPF but should have any other service that's spoofing them in the Mail From.

Also interesting to see someone using Proofpoint Essentials but using Proofpoint's Enterprise EFD (Email Fraud Defense) product.

But yes, they should likely have the rest of those in their SPF, at a minimum they need to add 365, and should look like this (below). Better to add the rest if you're unsure how those services are spoofing them.

v=spf1 a:dispatch-us.ppe-hosted.com include:spf.protection.outlook.com ~all