Higher than expected message volume due to DMARC failures reports

Products

• Messaging Gateway

Issue/Introduction

Administrators may notice a higher than expected volume of Non-Delivery Report (NDR) messages originating from a specific mail server and passing through the Messaging Gateway. 

Environment

 

DMARC Reporting is enabled in your Messaging Gateway deployment.

 

Cause

 

The sequence that causes this increase in volume is as follows:

• The Messaging Gateway sends a DMARC failure report to the email address defined in the recipient's DMARC record.

• The recipient's mail server rejects the report, triggering an NDR.

• This NDR message itself fails DMARC validation.

• The Messaging Gateway, following its configuration, attempts to send a failure report for the failed NDR message.

The cycle continues, leading to an increase in messages being processed and a potential loop.

 

Resolution

Temporary Mitigation

To break the loop and reduce the message volume temporarily, you can disable DMARC failure reporting in Symantec Messaging Gateway:

1. Navigate to:
   Spam > Settings > Sender Authentication

2. Uncheck the option:
   "Enable Failure Reports"

This action stops SMG from generating and sending DMARC failure reports, effectively halting the NDR loop.

Long-Term Resolution

While disabling failure reporting is an immediate workaround, it is not a recommended long-term solution, as it compromises the visibility of DMARC failures.

Instead, administrators of the recipient's domain should be advised to:

1. Correct their DMARC configuration to ensure proper alignment and authentication.

2. Ensure the email address listed in the DMARC ruf field is valid, active, and capable of receiving messages.

By addressing the root cause, the integrity of DMARC reporting can be maintained without causing system inefficiencies or loops.