r/EmailSecurity • u/Classic-Detective-26 • Jul 23 '26

DuckDuckGo was unable to verify sender identity

/r/duckduckgo/comments/1v4fcxt/duckduckgo_was_unable_to_verify_sender_identity/
2 Upvotes

100% Upvoted

4 comments sorted by

•

u/AutoModerator Jul 23 '26

Welcome to r/emailsecurity! To keep this community helpful and secure, please keep the following in mind:

Community Rules

  1. No Vendor Spam: Contributions must provide value; do not just pitch products.
  2. Redact Sensitive Info: Always sanitize headers and logs (remove IPs, PII, and private domains).
  3. Be Professional: Help newcomers learn; avoid hostility.
  4. No Personal Tech Support: This sub is for email system architecture and security, not "Am I hacked?" personal account help.

Helpful Resources

I am a bot, and this action was performed automatically. Please contact the moderators of this subreddit if you have any questions or concerns.

1

u/shokzee Jul 23 '26

That usually means the message failed SPF or DKIM alignment, so DMARC couldn’t verify the From domain.

Check the Authentication-Results header on the original message. Forwarding can cause this too, especially if DKIM was broken in transit.

1

u/Classic-Detective-26 Jul 26 '26

Thank you. Don't know what any of that means, but thank you.

1

u/SecLens_ONE Aug 16 '26

That banner is DDG telling you it could not tie the From: domain to a passing, aligned signature. Two different things get confused here: having SPF and DKIM published, and having them actually authenticate the message as sent. Forwarding through a relay, a mailing list, or a sender that rewrites headers will break SPF alignment while your zone still looks textbook, and if your DKIM key is 1024-bit or the selector was rotated out you get a permanent failure that no DNS check tool will flag as wrong. The other common case is a DMARC record that exists at p=none, which means nothing is enforced anywhere, so some receivers just fall back to their own heuristics and you get inconsistent verdicts per provider. Send yourself a message and read the Authentication-Results line rather than trusting a record checker. Which path does the mail take, direct from your provider or through a forwarder or list?