Why does DMARC verification fail on read receipts?

[keithsauer507]

I notice in our one quarantine where we throw anti-spoofing messages and failed DMARC messages, we get a lot of what looks like read receipts.  I see common sender address domains like yahoo, aol, etc... but the subject begins with Read: like its a return read receipt.  The reason for quarentine is: DMARC verification failed - Quarantined for DMARC verification failure.

We just updated to 9.7.2-047 to try to mitigate a bug on our older 9.7.1 version where spf records with domains beginning or ending with an underscore fail.

Any idea why?

[Mathew Huynh]

Hey Keith,

Within the quarantine, you can check the headers of the email and check upon what results are seen on SPF+DKIM+DMARC for these read recipients.

Depending on the results of them it may further give visibility into why DMARC is failing on these read receipts.

Regards,

Matthew