{"id":2304,"date":"2026-01-16T21:09:22","date_gmt":"2026-01-16T21:09:22","guid":{"rendered":"https:\/\/ssblog.eu.enginyr.ing\/?p=2304"},"modified":"2026-01-16T21:12:00","modified_gmt":"2026-01-16T21:12:00","slug":"rapoartele-dmarc-explicate-cum-sa-le-citesti-si-sa-repari-esecurile-de-autentificare","status":"publish","type":"post","link":"https:\/\/www.serverspan.ro\/blog\/rapoartele-dmarc-explicate-cum-sa-le-citesti-si-sa-repari-esecurile-de-autentificare\/","title":{"rendered":"Rapoartele DMARC explicate: Cum s\u0103 le cite\u0219ti \u0219i s\u0103 repari e\u0219ecurile de autentificare"},"content":{"rendered":"\n<p class=\"wp-block-paragraph\">Ai activat monitorizarea DMARC, iar acum inboxul t\u0103u este inundat de ata\u0219amente XML arhivate de la Google, Microsoft \u0219i Yahoo. Acestea sunt Rapoarte Agregate DMARC (RUA). Par de ne\u00een\u021beles pentru ochiul uman, dar con\u021bin singurele date definitive despre cine trimite emailuri \u00een numele <a href=\"https:\/\/www.serverspan.ro\/blog\/cum-sa-transferi-un-domeniu-fara-downtime-mutare-registrar-cutover-dns-si-siguranta-email-ului\/\">domeniului t\u0103u<\/a> \u2014 \u0219i dac\u0103 trec sau nu de autentificare.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Ignorarea acestor rapoarte este motivul num\u0103rul 1 pentru care proiectele DMARC se blocheaz\u0103. F\u0103r\u0103 s\u0103 le cite\u0219ti, nu po\u021bi trece la o politic\u0103 de &#8220;reject&#8221; (respingere) pentru c\u0103 nu \u0219tii ce expeditori legitimi (cum ar fi CRM-ul, helpdesk-ul sau instrumentul de facturare) ai bloca. Acest ghid explic\u0103 cum s\u0103 cite\u0219ti aceste rapoarte, ce \u00eenseamn\u0103 datele \u0219i exact cum s\u0103 repari erorile &#8220;Auth Fail&#8221; pe care le g\u0103se\u0219ti.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Ce este un Raport Agregat DMARC?<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Un raport agregat DMARC este un rezumat zilnic trimis de un receptor de email (precum Gmail sau Office 365) c\u0103tre adresa de email specificat\u0103 \u00een tag-ul <code>rua=<\/code> al \u00eenregistr\u0103rii tale DMARC. Nu con\u021bine emailurile propriu-zise sau con\u021binut sensibil. \u00cen schimb, este o list\u0103 statistic\u0103 a fiec\u0103rei adrese IP care a pretins c\u0103 este domeniul t\u0103u \u00een ziua anterioar\u0103.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Fiecare raport r\u0103spunde la trei \u00eentreb\u0103ri critice pentru o perioad\u0103 specific\u0103 de 24 de ore:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Cine a trimis emailuri?<\/strong> Adresele IP \u0219i hostname-urile expeditorilor.<\/li>\n\n\n\n<li><strong>Au trecut de SPF \u0219i DKIM?<\/strong> Rezultatele brute ale autentific\u0103rii.<\/li>\n\n\n\n<li><strong>S-au aliniat?<\/strong> Dac\u0103 domeniul autentificat s-a potrivit cu domeniul vizibil &#8220;From&#8221; (cheia pentru a trece de DMARC).<\/li>\n<\/ul>\n\n\n\n<h2 class=\"wp-block-heading\">Cum s\u0103 cite\u0219ti XML-ul (F\u0103r\u0103 s\u0103 te pierzi \u00een el)<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">De\u0219i ar trebui s\u0103 folose\u0219ti un instrument pentru a vizualiza aceste date (vezi &#8220;Instrumente&#8221; mai jos), \u00een\u021belegerea XML-ului brut te ajut\u0103 s\u0103 depanezi cazurile dificile. Iat\u0103 anatomia unei \u00eenregistr\u0103ri din raport:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>&lt;record&gt;\n  &lt;row&gt;\n    &lt;source_ip&gt;192.0.2.1&lt;\/source_ip&gt;\n    &lt;count&gt;50&lt;\/count&gt;\n    &lt;policy_evaluated&gt;\n      &lt;disposition&gt;none&lt;\/disposition&gt;\n      &lt;dkim&gt;fail&lt;\/dkim&gt;\n      &lt;spf&gt;pass&lt;\/spf&gt;\n    &lt;\/policy_evaluated&gt;\n  &lt;\/row&gt;\n  &lt;identifiers&gt;\n    &lt;header_from&gt;domeniultau.com&lt;\/header_from&gt;\n  &lt;\/identifiers&gt;\n  &lt;auth_results&gt;\n    &lt;spf&gt;\n      &lt;domain&gt;terta-parte.com&lt;\/domain&gt;\n      &lt;result&gt;pass&lt;\/result&gt;\n    &lt;\/spf&gt;\n    &lt;dkim&gt;\n      &lt;domain&gt;&lt;\/domain&gt;\n      &lt;result&gt;none&lt;\/result&gt;\n    &lt;\/dkim&gt;\n  &lt;\/auth_results&gt;\n&lt;\/record&gt;<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Aceast\u0103 singur\u0103 \u00eenregistrare spune o poveste complet\u0103:<\/p>\n\n\n\n<ol class=\"wp-block-list\">\n<li><strong>Expeditorul:<\/strong> IP-ul 192.0.2.1 a trimis 50 de emailuri.<\/li>\n\n\n\n<li><strong>Problema:<\/strong> SPF a trecut (tehnic), dar DMARC probabil a e\u0219uat sau s-a bazat pur pe alinierea SPF. Observi <code>&lt;domain&gt;terta-parte.com&lt;\/domain&gt;<\/code> \u00een sec\u021biunea SPF? Serverul a fost autorizat de <em>terta-parte.com<\/em>, nu de <em>domeniultau.com<\/em>.<\/li>\n\n\n\n<li><strong>Lipsa de Aliniere:<\/strong> Expeditorul vizibil (<code>header_from<\/code>) este <em>domeniultau.com<\/em>, dar calea de retur SPF (<code>domain<\/code>) este <em>terta-parte.com<\/em>. Dac\u0103 acestea nu se potrivesc, Alinierea SPF e\u0219ueaz\u0103.<\/li>\n<\/ol>\n\n\n\n<h2 class=\"wp-block-heading\">Conceptul de baz\u0103: Aliniere vs. Autentificare<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Aici se blocheaz\u0103 90% dintre administratori. S-ar putea s\u0103 vezi &#8220;SPF Pass&#8221; \u00een raportul t\u0103u, dar &#8220;DMARC Fail&#8221;. De ce? Din cauza <strong>Alinierii<\/strong>.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">DMARC cere ca domeniul care face autentificarea s\u0103 se potriveasc\u0103 cu domeniul din antetul &#8220;From:&#8221;.<\/p>\n\n\n\n<figure class=\"wp-block-table\"><table><thead><tr><th>Verificare<\/th><th>Cerin\u021b\u0103<\/th><th>Scenariu Comun de E\u0219ec<\/th><\/tr><\/thead><tbody><tr><td><strong>Autentificare SPF<\/strong><\/td><td>Este IP-ul autorizat s\u0103 trimit\u0103?<\/td><td>IP-ul este permis, dar pentru <em>domeniul gre\u0219it<\/em> (ex. domeniul SendGrid, nu al t\u0103u).<\/td><\/tr><tr><td><strong>Aliniere SPF<\/strong><\/td><td>Return-Path se potrive\u0219te cu From?<\/td><td>Folosirea unui instrument ter\u021b care gestioneaz\u0103 bounce-urile (<a href=\"https:\/\/www.serverspan.ro\/blog\/configurarea-infrastructurii-de-email-configurarea-exim-pe-vps-linux-ghid-complet-pentru-administratori-de-sistem\/\">Return-Path<\/a>) pe propriul domeniu.<\/td><\/tr><tr><td><strong>Autentificare DKIM<\/strong><\/td><td>Este semn\u0103tura valid\u0103?<\/td><td>Corpul mesajului modificat \u00een tranzit; e\u0219ec la rota\u021bia cheilor.<\/td><\/tr><tr><td><strong>Aliniere DKIM<\/strong><\/td><td>Tag-ul d= se potrive\u0219te cu From?<\/td><td>Semnarea cu cheia generic\u0103 a vendorului (d=sendgrid.net) \u00een loc de cheia domeniului t\u0103u personalizat.<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n<h2 class=\"wp-block-heading\">Repararea E\u0219ecurilor Comune de Autentificare<\/h2>\n\n\n\n<h2 class=\"wp-block-heading\">Scenariul 1: &#8220;SPF Nealiniat&#8221; (Mailchimp, SendGrid, Zendesk)<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Simptomul:<\/strong> SPF spune &#8220;Pass&#8221;, dar domeniul listat este <code>mcsv.net<\/code> sau <code>sendgrid.net<\/code>, \u00een timp ce header-ul from este <code>companiata.com<\/code>. DMARC e\u0219ueaz\u0103 la alinierea SPF.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Solu\u021bia:<\/strong> Nu po\u021bi repara alinierea SPF pentru multe servicii g\u0103zduite deoarece ele trebuie s\u0103 gestioneze bounce-urile (Return-Path) pe propriile servere. \u00cen schimb, <strong>trebuie s\u0103 configurezi DKIM<\/strong>. DMARC trece dac\u0103 <em>oricare<\/em> dintre SPF sau DKIM se aliniaz\u0103. Logheaz\u0103-te la <a href=\"https:\/\/www.serverspan.ro\/blog\/gazduire-email-business-de-ce-email-ul-gratuit-esueaza-la-scara\/\">furnizorul t\u0103u de email<\/a>, g\u0103se\u0219te set\u0103rile de &#8220;Domain Authentication&#8221; \u0219i genereaz\u0103 <a href=\"https:\/\/www.serverspan.ro\/blog\/propagarea-dns-demistificata-cum-sa-verifici-ce-vede-lumea-pas-cu-pas\/\">\u00eenregistr\u0103rile CNAME<\/a> pentru a activa semnarea DKIM pentru domeniul t\u0103u specific.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Scenariul 2: &#8220;Distrug\u0103torul prin Redirec\u021bionare&#8221; (Forwarding)<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Simptomul:<\/strong> Vezi e\u0219ecuri DMARC de la IP-uri aleatorii pe care nu le recuno\u0219ti, dar rezultatul DKIM spune &#8220;pass&#8221; (dac\u0103 e prezent) sau &#8220;fail&#8221; (dac\u0103 corpul a fost schimbat). IP-urile apar\u021bin adesea universit\u0103\u021bilor sau ISP-urilor.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Realitatea:<\/strong> Aceasta este auto-redirec\u021bionare (auto-forwarding). Cineva de la o universitate \u0219i-a redirec\u021bionat emailul de alumni c\u0103tre Gmail. Serverul universit\u0103\u021bii a trimis emailul, stric\u00e2nd SPF (pentru c\u0103 IP-ul universit\u0103\u021bii nu e \u00een \u00eenregistrarea ta). Dac\u0103 ai o semn\u0103tur\u0103 DKIM valid\u0103 \u0219i aliniat\u0103, emailul supravie\u021buie\u0219te redirec\u021bion\u0103rii. Dac\u0103 te bazezi doar pe SPF, emailul pic\u0103 DMARC.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Solu\u021bia:<\/strong> Asigur\u0103-te c\u0103 100% din mailul t\u0103u legitim este semnat DKIM. Nu po\u021bi &#8220;repara&#8221; serverele de redirec\u021bionare, dar DKIM permite mailului t\u0103u s\u0103 supravie\u021buiasc\u0103 saltului.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Scenariul 3: &#8220;Nepotrivirea Subdomeniului&#8221;<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Simptomul:<\/strong> Trimi\u021bi mail de pe <code>marketing.domeniultau.com<\/code>. \u00cenregistrarea ta SPF acoper\u0103 <code>domeniultau.com<\/code>. DMARC e\u0219ueaz\u0103.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Solu\u021bia:<\/strong> SPF nu mo\u0219tene\u0219te permisiunile. Ai nevoie de o \u00eenregistrare TXT separat\u0103 pentru <code>marketing.domeniultau.com<\/code>. Alternativ, verific\u0103 modul de aliniere DMARC. Dac\u0103 politica ta spune <code>aspf=s<\/code> (strict), subdomeniile e\u0219ueaz\u0103. Valoarea implicit\u0103 este <code>aspf=r<\/code> (relaxed), care permite ca <code>marketing.domeniultau.com<\/code> s\u0103 se alinieze cu <code>domeniultau.com<\/code>.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Instrumente pentru Vizualizarea Rapoartelor RUA<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Nu \u00eencerca s\u0103 cite\u0219ti fi\u0219ierele XML manual \u00een fiecare zi. Folose\u0219te un instrument pentru a le agrega \u00een dashboard-uri.<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Gratuit\/Open Source:<\/strong> Parsedmarc (self-hosted), Postmark DMARC (doar rezumate s\u0103pt\u0103m\u00e2nale).<\/li>\n\n\n\n<li><strong>Comercial (SaaS):<\/strong> Valimail, Dmarcian, Uriports. Acestea ofer\u0103 forensic detaliat \u0219i categorisirea expeditorilor.<\/li>\n\n\n\n<li><strong>Verificare Rapid\u0103:<\/strong> MXToolbox DMARC Report Analyzer (\u00eencarc\u0103 un singur fi\u0219ier XML pentru vizualizare instant\u0103).<\/li>\n<\/ul>\n\n\n\n<h2 class=\"wp-block-heading\">C\u00e2nd s\u0103 ignori e\u0219ecurile<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Nu orice &#8220;Fail&#8221; dintr-un raport trebuie reparat. Vei vedea constant e\u0219ecuri de la:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Spammer-i\/Spoofer-i:<\/strong> IP-uri din Rusia sau China trimi\u021b\u00e2nd ca domeniul t\u0103u f\u0103r\u0103 autentificare. <strong>Acesta este un lucru bun.<\/strong> Politica ta DMARC \u00eei identific\u0103. Odat\u0103 ce treci la p=reject, ace\u0219tia sunt bloca\u021bi.<\/li>\n\n\n\n<li><strong>Invita\u021bii Calendar (uneori):<\/strong> Invita\u021biile auto-generate redirec\u021bionate \u00eentre sisteme pot strica uneori alinierea.<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">Scopul t\u0103u nu este o rat\u0103 de e\u0219ec de 0%; este o rat\u0103 de e\u0219ec de 0% pentru <em>infrastructura ta legitim\u0103<\/em>.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>Ai activat monitorizarea DMARC, iar acum inboxul t\u0103u este inundat de ata\u0219amente XML arhivate de la Google, Microsoft \u0219i Yahoo. Acestea sunt Rapoarte Agregate DMARC (RUA). Par de ne\u00een\u021beles pentru ochiul uman, dar con\u021bin singurele date definitive despre cine trimite emailuri \u00een numele domeniului t\u0103u \u2014 \u0219i dac\u0103 trec sau nu de autentificare. Ignorarea acestor [&hellip;]<\/p>\n","protected":false},"author":1,"featured_media":2300,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[9],"tags":[13628,13631,13629,13627,13633,13635,13634,13632,13624,13626,13630,13625],"class_list":["post-2304","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-tutorials","tag-aliniere-dkim-explicata","tag-aliniere-dmarc-relaxed-vs-strict","tag-analiza-raport-rua","tag-citire-raport-xml-dmarc","tag-depanare-autentificare-email","tag-depanare-dmarc-reject","tag-instrumente-gratuite-analiza-dmarc","tag-probleme-redirectionare-dmarc","tag-rapoarte-agregate-dmarc-explicate","tag-reparare-esec-aliniere-dmarc","tag-reparare-esec-autentificare-dmarc","tag-spf-pass-dar-dmarc-fail"],"_links":{"self":[{"href":"https:\/\/www.serverspan.com\/blog\/index.php?rest_route=\/wp\/v2\/posts\/2304","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.serverspan.com\/blog\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.serverspan.com\/blog\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.serverspan.com\/blog\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.serverspan.com\/blog\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=2304"}],"version-history":[{"count":3,"href":"https:\/\/www.serverspan.com\/blog\/index.php?rest_route=\/wp\/v2\/posts\/2304\/revisions"}],"predecessor-version":[{"id":2307,"href":"https:\/\/www.serverspan.com\/blog\/index.php?rest_route=\/wp\/v2\/posts\/2304\/revisions\/2307"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.serverspan.com\/blog\/index.php?rest_route=\/wp\/v2\/media\/2300"}],"wp:attachment":[{"href":"https:\/\/www.serverspan.com\/blog\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=2304"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.serverspan.com\/blog\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=2304"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.serverspan.com\/blog\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=2304"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}