DMARC reporting errors with self-authentication

Why you can see multiple DKIM signatures (double DKIM signing) in your DMARC reporting when you use self-authentication

A DMARC policy allows domain owners to assert several things in their policy record. One of these things is where to send reports if a message sent by your domain fails authentication. There are many third-party reporting agencies that help domain owners parse these reports to determine where non-compliant emails are being sent from. While Constant Contact makes every effort to ensure that all of your emails are delivered in accordance with the industry standards for authentication, we've seen some reporting agencies have issues parsing messages when more than one DKIM signature is present.

• How Constant Contact signs email
• How multiple DKIM signatures are reported
• Different types of reporting

How Constant Contact signs email

Constant Contact signs all outbound email with a default DKIM key: d=auth.ccsend.com. If you opt to self-authenticate, we add a second key customized with your domain: d=yourdomain.com. As a result, there are two DKIM signatures that appear in the message headers. For this reason, multiple DKIM signatures are allowed within the DKIM framework.

How multiple DKIM signatures are reported

Most ISPs (Internet Service Providers) or mailbox providers see both the default key (d=auth.ccsend.com) and the custom key (d=yourdomain.com), and will validate the message using both. In some cases, these receiving domains stop after validating only the auth.ccsend.com DKIM signature. This causes the messages to appear to fail a DMARC check on your domain and get reported to the DMARC reporting agencies.

For our customers who sign with two DKIM-authenticated domains and use DMARC p=reject, all email is typically delivered as aligned. This only appears to be a failure in the reporting.

Different types of reporting

When a DMARC policy is deployed, for most domains, you can configure a report to provide information on which emails are failing authentication in accordance with your DMARC policy. These are defined as either:

• An Aggregate Report (RUA)
• A Failure/Forensic Report (RUF)

Any issues with double DKIM reporting only show if an RUF report has been configured for the sender's domain. In most cases, these reports show a failure when the “d=auth.ccsend.com” is being read before the custom DKIM key provided by Constant Contact.

Questions?