Weird email sender in DMARC reports

[dean14]

So, im getting this weird sender showing up in my DMARC reports.

It’s passing DMARC but failing DKIM, and I have no idea who or what it is.

Any ideas?

Thanks

[epic.network]

The IP you listed is a MailChannels address. Do you use MailChannels and include them in your SPF?

[dean14]

No, not that im aware of.

[epic.network]

Without your domain name there is nothing else we can look at.

[dean14]

Ok, i’ve done some investigation and it appears that my hosting provider is routing the mail through mail channels.

After routing through mail channels, the DKIM is failing.

Any way to fix this?

[dean14]

ARC-Authentication-Results: i=2; mx.google.com;
       dkim=fail [email protected] header.s=default header.b=W2S46psi;
       arc=pass (i=1);
       spf=pass (google.com: domain of DOMAIN.COM designates 23.83.219.7 as permitted sender) smtp.mailfrom=DOMAIN.COM;
       dmarc=pass (p=REJECT sp=REJECT dis=NONE) header.from=DOMAIN.COM
Return-Path: <DOMAIN.COM>
Received: from azure.pine.relay.mailchannels.net (azure.pine.relay.mailchannels.net. [23.83.219.7])
        by mx.google.com with ESMTPS id o12-20020a655bcc000000b0055c881a2c18si2673947pgr.284.2023.07.21.03.37.49
        for <RETRACTED>
        (version=TLS1_2 cipher=ECDHE-ECDSA-AES128-GCM-SHA256 bits=128/128);
        Fri, 21 Jul 2023 03:37:51 -0700 (PDT)
Received-SPF: pass (google.com: domain of DOMAIN.COM designates 23.83.219.7 as permitted sender) client-ip=23.83.219.7;
Authentication-Results: mx.google.com;
       dkim=fail [email protected] header.s=default header.b=W2S46psi;
       arc=pass (i=1);
       spf=pass (google.com: domain of DOMAIN.COM designates 23.83.219.7 as permitted sender) smtp.mailfrom=DOMAIN.COM;
       dmarc=pass (p=REJECT sp=REJECT dis=NONE) header.from=DOMAIN.COM
X-Sender-Id: instrampxe0y3a|x-authuser|@DOMAIN.COM
Received: from relay.mailchannels.net (localhost [127.0.0.1]) by relay.mailchannels.net (Postfix) with ESMTP id 895D37A091E for <RETRACTED>; Fri, 21 Jul 2023 10:37:46 +0000 (UTC)
Received: from cpanel-011-syd.hostingww.com (unknown [127.0.0.6]) (Authenticated sender: instrampxe0y3a) by relay.mailchannels.net (Postfix) with ESMTPA id 11F5E7A08A4 for <RETRACTED>; Fri, 21 Jul 2023 10:37:45 +0000 (UTC)

[epic.network]

You may need to adjust how you DKIM sign to prevent downstream changes from invalidating your DKIM signature. Your host will need to work with you to ensure that they do not cause your DKIM to fail. It is not something that can be fixed in Cloudflare