Subject: [dmarc-ietf] Strange dmarc lookups

From: "John R. Levine" <[email-masked]>
Date: 26 Mar 2018 21:13:09 +0100

A friend looking at DNS traces says he's seeing a lot of queries like 
this.

_dmarc.78.0x18.00000143.0031

The numbers vary, some don't have the 0x.  Any idea what it is?  The 
_dmarc suggest something thinks it's finding those domains on From: lines 
but I'm having trouble imagining what it is.

Regards,
John Levine, [email-masked], Primary Perpetrator of "The Internet for Dummies",
Please consider the environment before reading this e-mail. https://jl.ly

---

From: "Kurt Andersen (b)" <[email-masked]>
Date: Mon, 26 Mar 2018 22:06:47 -0700

Looks like an abuse campaign doing what it can to mask sending from
something like a direct IP based address like @[w.x.y.z] - in this case the
IP is reportedly in Madrid.

--Kurt

On Mon, Mar 26, 2018 at 1:13 PM, John R. Levine <[email-masked]> wrote:

> A friend looking at DNS traces says he's seeing a lot of queries like this.
>
> _______________________________________________
> dmarc mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/dmarc
>