Topic: possible issue with DMARC bouncing email

[robf355]

Hi
I'm not sure if this is an issue with sme, but since emailling to 9.2 I am getting the same email sent to me every day, the email is:
"Hello,

000webhost support is provided on community support forums. Search for more information regarding your issue. Create new topic explaining your concern when no similar topic was found in tutorials category. Thank you for using 000webhost services.

Check status page before submitting error report http://status.000webhost.com/"
There is then a corresponding dmarc log entry:
"ID: 858
000webhost.com
rua:   mailto:clients@000webhost.com
SSL connection failed
   SSL connection failed
delivering message to clients@000webhost.com, via 127.0.0.1
deleting report 858
deleting report_record_spf rows 1398
deleting report_record_dkim rows 1398
deleting report_record_reason rows 1398
sleeping 5.....done."
The the next day I get the same email back with the submission date changed to the previous day.
My question is could the dmarc reply be triggering the support email each day?
I have tried emailing 000webhost but No reponse, I've never visited this site
Can anyone suggest a remedy?
Regards
Rob Carter

[ReetP]

It may be this bug is related:

https://bugs.contribs.org/show_bug.cgi?id=10320

Possibly your server is sending a DMARC report to a non existent address

With the update to the rpm the reporting should be disabled by default.

B. Rgds
John

[Daniel B.]

The problem here is that 000webhost.com (or to be more precise, a domain to which you've sent an email, and whose DMARC entry points the rua to clients@000webhost.com) made a mistake in their configuration: email addresses for DMARC rua should not send an auto reply like this. But anyway, it shouldn't be sent to you either. I found no information in any document regarding the From and Return-Path which should be used when sending aggregate reports like this. Maybe we should set the Return-Path to the null sender, to prevent getting bounces and auto-reply from badly configured servers

[ReetP]

I'd agree there is a good case to try and prevent confusing messages for users.

[brianr]

The problem here is that 000webhost.com (or to be more precise, a domain to which you've sent an email, and whose DMARC entry points the rua to clients@000webhost.com) made a mistake in their configuration: email addresses for DMARC rua should not send an auto reply like this. But anyway, it shouldn't be sent to you either. I found no information in any document regarding the From and Return-Path which should be used when sending aggregate reports like this. Maybe we should set the Return-Path to the null sender, to prevent getting bounces and auto-reply from badly configured servers

I like the sound of that, I get a lot of these every day!

[robf355]

Hi
Thanks for the replies, I got rid of the constant new emails by disabling DMARC, their email seems to be hosted on a  google server: 000webhost-com.20150623.gappssmtp.com, and it seems like they just presume any email to this address is sent as a support request?
Regards
Rob

[brianr]

Hi
Thanks for the replies, I got rid of the constant new emails by disabling DMARC, their email seems to be hosted on a  google server: 000webhost-com.20150623.gappssmtp.com, and it seems like they just presume any email to this address is sent as a support request?
Regards
Rob

Its real shame (IMHO) that you've had to disable DMARC - I feel it is a real step forward (even if it is a bit of a hotch-potch) in making email more secure and reliable.

[robf355]

I'll try re-enabling it and see if the problem comes back, it shouldn't with this particular website as I would think i've broken the loop so to speak.

[robf355]

I re-enabled DMARC and the problem email came back, is there a table or file that stores entries that need to have the dmarc response?
Rob

[Daniel B.]

an SQLite DB: /var/lib/qpsmtpd/dmarc/reports.sqlite

[mauro]

I get a similar emails from 000webhost.com on a daily basis.
I feel we have we created a loop here. I mean, for each of those emails I send back a DMARC report which bounces back and so on and so on...
Is there any easier way to break this chain than messing in the sqlite database? For example if I blacklist this server in the wbl contrib will that skip the DMARC routines?