Unknown senders in DMARC reports
Reports show sources not yet inventoried or authorized.
Problem summary
Reports show sources not yet inventoried or authorized.
Symptoms
- rua shows IPs/platforms you do not recognize
- Cannot tell spoofing from shadow IT
- Inventory incomplete before enforcement
Possible causes
- Untracked ESP, CRM, or printer/scanner streams
- Spoofing and lookalike traffic
- Acquired brands still sending
How to diagnose
- Classify sources by volume, PTR, and known vendor ranges
- Interview marketing/IT for shadow senders
- Sample headers when possible
How to fix
- Authorize and align real first-party sources
- Retire or rebrand abandoned streams
- Leave true spoofing unauthorized under DMARC enforcement
How to verify
- Inventory covers material report volume
- Remaining unknowns are accepted as hostile/spoof
Prevention
- Maintain a living sender inventory
- Review rua weekly during p=none
When to escalate
- Production mail is failing for a material share of recipients after remediation attempts