Servers sending email as your domain without permission

What this means

Every day, the big mailbox providers send your domain DMARC aggregate reports: which servers sent email claiming to be from you, how many messages, and whether each passed SPF and DKIM for your domain. Most of the volume should come from the services you use, such as Microsoft 365, Google Workspace or your newsletter tool, and pass at least one of the two.

An unauthorised sender is a server in those reports that passed neither. Its address isn't covered by your SPF record, and its messages carried no valid DKIM signature for your domain. Receivers judged its email as failing DMARC and applied your policy to it.

Address

The IP address the email came from, as the receiver saw it.

Reverse DNS

The name the address's owner gave it, which often shows the hosting company.

Emails

How many messages it sent as your domain in the last 30 days.

If it's one of yours

A steady sender, sending on working days, with a reverse DNS name you recognise, is often a service someone at the organisation set up and never authorised: an invoicing system, a CRM, a booking tool or the website's contact form. Its email is being treated as forged today, so customers may not be getting it.

• Find the service from the reverse DNS name, or by asking who sends what. The volume and days usually give it away.
• Turn on DKIM signing for your domain in that service. This is the better fix: it survives forwarding and doesn't use up SPF lookups.
• If the service can't sign, add it to your SPF record with the include its set-up guide gives.

If it isn't yours

A server sending a handful of messages, from a cloud host or a country you don't work in, is usually someone forging your address, for spam or phishing. There is nothing to fix on the server itself, and you shouldn't add it to SPF. What protects you is your DMARC policy: at p=quarantine or p=reject, receivers send its email to spam or refuse it. At p=none they may still deliver it, so moving up is the next step.

Why it doesn't affect the grade

Spoofers often use servers that are already on blacklists. If we counted those listings, a stranger forging your address could lower your grade, and there would be nothing you could do about it. So we check only your mail servers and the senders you have authorised against blacklists, and show unauthorised senders separately for you to review. If you later authorise one, it starts being checked like the rest.