Troubleshoot why DMARC Aggregate Feedback Report Not Generated

Introduction

This document describes how to troubleshoot why the DMARC aggregate feedback report is not generated.

Background Information

The appliance can verify incoming emails using Domain-based Message Authentication, Reporting, and Conformance (DMARC) and send DMARC aggregate feedback reports to domain owners to help strengthen their authentication deployments. These reports are in XML format, archived into a GZip file, and can be sent out on a daily basis. A DMARC aggregate report is generated if there is at least one instance of verification in the 24-hour window, regardless of the verification result.

A successful generated report can be confirmed within the mail_logs as follows:

Tue Feb  4 00:00:00 2014 Info: DMARC REPORT: Starting Aggregate report generation
Tue Feb  4 00:00:05 2014 Info: DMARC REPORT: Aggregate report has been generated for the domain gmail.com
Tue Feb  4 00:00:05 2014 Info: DMARC REPORT: Dispatching DMARC report for domain example.com to dmarc_reply@example.com, user@internaldomain.com
Tue Feb  4 00:00:06 2014 Info: DMARC REPORT: Completed Aggregate report generation

Troubleshoot

If a DMARC aggregate feedback report is not generated, verify the following:

Step 1. Determine within the mail_logs which mail flow policy has been applied on the connecting host and verify if the option, Send aggregate feedback reports within the DMARC Verification settings in this mail flow policy, has been enabled.

Step 2. Determine the DMARC Verification result in the corresponding mail_log excerpts:

An aggregate feedback report is generated when the DMARC verification was passed or failed:

Mon Feb  3 16:04:33 2014 Info: MID 1122 DMARC: Verification passed.
Wed Feb  5 23:59:33 2014 Info: MID 1234 DMARC: Verification failed.

An aggregate feedback report CANNOT be generated when the DMARC verification is skipped:
Sun Feb  2 21:45:32 2014 Info: MID 1010 DMARC: Verification skipped (No record found for the sending domain)

The ESA buffers the DMARC verification data before writing to the database, and records are written to the database every 15 minutes. If a DMARC verification was done close to report generation schedule (for example, sample MID 1234 with a schedule of 12am), this message can be included in the next day's report.

Step 3. An additional requirement is that the sending domains DMARC record has a mailto URI, otherwise the report is not generated. Listed here you can find some examples for an existing and non-existing mailto URI within the RUA tag of DMARC record.

CLI> dig txt _dmarc.gmail.com


; <<>> DiG 9.6.-ESV-R3 <<>> _dmarc.gmail.com TXT
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 41375
;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 0

;; QUESTION SECTION:
;_dmarc.gmail.com.              IN      TXT

;; ANSWER SECTION:
_dmarc.gmail.com.       1800    IN      TXT     "v=DMARC1\; p=none\; rua=mailto:mailauth-reports@google.com"

;; Query time: 35 msec
;; SERVER: 127.0.0.1#53(127.0.0.1)
;; WHEN: Tue Feb 18 13:48:02 2014
;; MSG SIZE  rcvd: 103

CLI> dig txt _dmarc.parallels.com


; <<>> DiG 9.6.-ESV-R3 <<>> _dmarc.parallels.com TXT
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 13092
;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 0

;; QUESTION SECTION:
;_dmarc.parallels.com.          IN      TXT

;; ANSWER SECTION:
_dmarc.parallels.com.   1800    IN      TXT     "v=DMARC1\;p=none"

;; Query time: 56 msec
;; SERVER: 127.0.0.1#53(127.0.0.1)
;; WHEN: Tue Feb 18 13:47:36 2014
;; MSG SIZE  rcvd: 66

Additionally, to configure the return address for sending DMARC feedback reports, navigate to System Administration > Return Addresses.

• Edit Settings.
• Set the DMARC Feedback return address to a valid email address.
• Submit and commit the changes.

This configuration ensures that DMARC aggregate feedback reports are sent from the specified return address.