Why strangers appear in your DMARC reports

Start reading your DMARC reports and within a week you will meet them: servers you have never heard of — a hosting company in another country, somebody's university relay — carrying mail that claims your domain. Before assuming an attack, look at one number: does that mail pass your DMARC? Because an unknown server whose mail passes is almost always the most mundane thing on the internet — a recipient forwarding your message somewhere else.

What forwarding does to authentication

Someone receives your invoice at their work address and has it auto-forwarded to their personal inbox. The final receiver — say Gmail — sees the message arrive not from your server but from the forwarder's, and reports it against your domain accordingly. SPF breaks in transit: your record authorizes your servers, and the forwarder's address is not among them (well-behaved forwarders rewrite the envelope — you may see their own domain in the SPF result, a scheme called SRS). But your DKIM signature travels inside the message, and as long as the forwarder passes it along untouched, it still validates. Signed at your server, verified anywhere — that survival through relays is much of why DKIM exists.

So the forwarding fingerprint in a report is: unknown IP, SPF failing or answering for some other domain, DKIM passing and aligned with yours. The message could only have originated on your own systems — a forwarder can relay your signature intact, but it cannot mint one, because it does not hold your key.

When an unknown sender actually matters

The shape to take seriously is the opposite one: volume from a source that aligns on nothing. No valid signature, no authorized address — mail none of your systems produced, wearing your name. That is either an attack or a forgotten integration someone connected without telling you, and conveniently the response is the same either way: an enforced policy, under which receivers junk or refuse it. A mailing list can blur the line — some lists modify messages in ways that break the signature, turning legitimate forwarded mail into failures — which is one reason the policy is best tightened gradually, watching the reports as you go.

How Sojka reads this shape

Sojka classifies every sending source from your reports, and forwards of your own mail are recognized by exactly the evidence above — your own DKIM selectors, intact, on mail from elsewhere. They are not flagged as threats and they do not count against your health score as unaccounted senders; they are your mail, in transit. The sources that never authenticate are the ones that raise a signal on your phone.

Check your domain free — it reads your public DNS and grades what is there.