Find out who an unknown source is
Check whether the source is yours
An unknown source sends mail as example.com from addresses that do not match a sending service we know. Most of these are services that someone at your organization signed up for.
- Open the source page. Look at its addresses, their reverse DNS names and the network each address belongs to. A reverse DNS name often names the service.
- Ask the people who run your website, invoicing, newsletters, CRM, helpdesk, and office printers or scanners. Each of these often sends mail as your domain.
- If one of them owns the source, set the service up. The guide on setting up DKIM for a sending service shows the steps.
- Rename the source on its page, so your reports show the service's name from then on.
If the source passes DMARC through DKIM but fails SPF, it is often forwarded mail. A mailing list, or a mailbox that forwards to another address, sends your mail on from its own servers. That mail needs nothing from you.
If nobody owns the source and its mail never passes DMARC, it is probably someone sending as example.com without your permission. A stricter DMARC policy tells mailbox providers to send that mail to spam or refuse it. The guide on moving to a stricter DMARC policy shows the steps.