<html><head><meta http-equiv="Content-Type" content="text/html; charset=utf-8"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;" class=""><div class="">Hey everyone,</div><div class=""><br class=""></div><div class="">I have a conflict with a provider from Russia "Timeweb" AS9123. It seems to be hosting a customer who sends spam and uses one of my domains as sender.<br class=""><br class="">I got the information via DMARC, RFC 7489 with several mails. This provider has an abuse email address. After I contacted them, they analyzed my domain, complained about the header of the automatic DMARC e-mail from <a href="http://mail.ru" class="">mail.ru</a>, because there an internal host distributes it and uses an internal IP address 10/8 according to RFC 1918 and so on.<br class=""><br class="">Apparently one does not want to do anything and requests one of these e-mails classified as spam sent to @mail.ru.<br class=""><br class="">But this is not provided for in the DMARC protocol, which the provider does not 'believe’.</div><div class=""><br class=""></div><div class="">This means I continue to receive emails from Russia telling me that my domain is being used by their host to send spam. And the provider writes me many e-mails telling me that I have to provide correct facts and that nothing else will be done.</div><div class=""><br class=""></div><div class="">Because DMARC emails are not facts and cannot be used as evidence.<br class=""><br class="">Do you have any idea how to deal with this?<br class=""><br class="">I have received 11 DMARC emails from <a href="http://mail.ru" class="">mail.ru</a> regarding this host. I have attached last one here with header:<br class=""><br class=""></div><div class="">Return-Path: <<a href="mailto:dmarc_support@corp.mail.ru" class="">dmarc_support@corp.mail.ru</a>><br class="">Delivered-To: <a href="mailto:mnin@mnin.de" class="">mnin@mnin.de</a><br class="">Received: from mail.mnin.de ([xxxx])<br class=""><span class="Apple-tab-span" style="white-space:pre"> </span>by mail.mnin.de with LMTP<br class=""><span class="Apple-tab-span" style="white-space:pre"> </span>id yedWJNMKx14sDAAAuS6XVA<br class=""><span class="Apple-tab-span" style="white-space:pre"> </span>(envelope-from <dmarc_support@corp.mail.ru>)<br class=""><span class="Apple-tab-span" style="white-space:pre"> </span>for <mnin@mnin.de>; Fri, 22 May 2020 01:12:19 +0200<br class="">Received: from relay7.m.smailru.net (relay7.m.smailru.net [94.100.178.51])<br class=""><span class="Apple-tab-span" style="white-space:pre"> </span>(using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits))<br class=""><span class="Apple-tab-span" style="white-space:pre"> </span>(No client certificate requested)<br class=""><span class="Apple-tab-span" style="white-space:pre"> </span>by mail.mnin.de (Postcow) with ESMTPS id 6D59868509C<br class=""><span class="Apple-tab-span" style="white-space:pre"> </span>for <mnin@mnin.de>; Fri, 22 May 2020 01:12:18 +0200 (CEST)<br class="">DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=corp.mail.ru; s=mail;<br class=""><span class="Apple-tab-span" style="white-space:pre"> </span>h=Date:Message-ID:To:From:Subject:MIME-Version:Content-Type; bh=DMqnfyeB+D0YjhIdtRipG66iEqaOVRHns+l07FJTLbw=;<br class=""><span class="Apple-tab-span" style="white-space:pre"> </span>b=k6PdTMpn2SHfn7HO4jdOto6jxVRnOLsCsFLz0Lp87ytUyQL7ifwnze/LC/xQlDQ1hLpkHdM/sM8RFDgusUQYtL4e7/Zkmln4vsjgPvsW6go/YK7hvaeQBKMKgDSXqTlTXqm7BUyXOU4g9wByuAWUM0UpOM+3lrgHzm7d/Fil5IU=;<br class="">Received: from [10.161.4.115] (port=48176 helo=60)<br class=""><span class="Apple-tab-span" style="white-space:pre"> </span>by relay7.m.smailru.net with esmtp (envelope-from <dmarc_support@corp.mail.ru>)<br class=""><span class="Apple-tab-span" style="white-space:pre"> </span>id 1jbuMI-0007Kr-2n<br class=""><span class="Apple-tab-span" style="white-space:pre"> </span>for mnin@mnin.de; Fri, 22 May 2020 02:12:14 +0300<br class="">Content-Type: multipart/mixed; boundary="===============1678280035031557895=="<br class="">MIME-Version: 1.0<br class="">Subject: Report Domain: mnin.de; Submitter: Mail.Ru;<br class=""> Report-ID: 25590927945792699841590019200<br class="">From: dmarc_support@corp.mail.ru<br class="">To: mnin@mnin.de<br class="">Message-ID: <dmarc-1590102734@corp.mail.ru><br class="">Date: Fri, 22 May 2020 02:12:14 +0300<br class="">Auto-Submitted: auto-generated<br class="">ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=mnin.de;<br class=""><span class="Apple-tab-span" style="white-space:pre"> </span>s=dkim; t=1590102738;<br class=""><span class="Apple-tab-span" style="white-space:pre"> </span>h=from:from:reply-to:subject:subject:date:date:message-id:message-id:<br class=""><span class="Apple-tab-span" style="white-space:pre"> </span> to:to:cc:mime-version:mime-version:content-type:content-type:<br class=""><span class="Apple-tab-span" style="white-space:pre"> </span> dkim-signature; bh=DMqnfyeB+D0YjhIdtRipG66iEqaOVRHns+l07FJTLbw=;<br class=""><span class="Apple-tab-span" style="white-space:pre"> </span>b=YpE4Z5u3l+mzLxsH+2Qbd39KekLCXa2jbbIrdnDxvgNFS6zvl4zKq33jQ/7fs5KkJEB0Xc<br class=""><span class="Apple-tab-span" style="white-space:pre"> </span>VCRT+1keQ9x/+a0tp6IMMUKE1elcOp6LHbBzTXCZYcgylnhbmb/JrCgAUI67KzXJlLn4o4<br class=""><span class="Apple-tab-span" style="white-space:pre"> </span>pxToLIR5HD58dGeler0v2GTby5si8GUfczS2mM4QAvxJHDSZ8GqTE359H8HTmXUXGBQRb+<br class=""><span class="Apple-tab-span" style="white-space:pre"> </span>0RVhhOzYxwmusEpWvuMcXYm4oZ7V+eKNuv12N5xCAbaWaqen37v1M53j0pu1vYoUSQBgOa<br class=""><span class="Apple-tab-span" style="white-space:pre"> </span>dv3UgtOSdPxj8wVI5OzpY6ZVKtfSqyTXW5dV+8yfZUSe1Zpm/UPOO5eaqyUnpw==<br class="">ARC-Seal: i=1; s=dkim; d=mnin.de; t=1590102738; a=rsa-sha256; cv=none;<br class=""><span class="Apple-tab-span" style="white-space:pre"> </span>b=keiIRdDt35e1bk6toEJdITgagC1CXQE81NoMoM8T19TBM9LFU4zudqRg73qPYgGkqvXqqI<br class=""><span class="Apple-tab-span" style="white-space:pre"> </span>Te3Z+AC+CZp9bxfqIOrm2xSE8fNfZEKYhl5fB59sen9/m1rwiZznvvbNcBCJMpytYyDAbg<br class=""><span class="Apple-tab-span" style="white-space:pre"> </span>l74M2uJVfvrUAoAbMF8dweJV/SANBC2K6eKs1r9nRu5DrCEcicWKNLxWbvZ7Q/TccUGgeZ<br class=""><span class="Apple-tab-span" style="white-space:pre"> </span>VCyYvxqc0m5U7wZqK/32Sgf1EpWAjkXpC5eTMxH73FfrIkpPQa8v5ag6qKMP+GRk8B3GO1<br class=""><span class="Apple-tab-span" style="white-space:pre"> </span>eQxsci0l3eATOMFFeEAW/QkSB+ur5f2bPEraluEN5VD4iwWzd2tBGmbcT0ZKaw==<br class="">ARC-Authentication-Results: i=1;<br class=""><span class="Apple-tab-span" style="white-space:pre"> </span>mail.mnin.de;<br class=""><span class="Apple-tab-span" style="white-space:pre"> </span>dkim=pass header.d=corp.mail.ru header.s=mail header.b=k6PdTMpn;<br class=""><span class="Apple-tab-span" style="white-space:pre"> </span>spf=pass (mail.mnin.de: domain of dmarc_support@corp.mail.ru designates 94.100.178.51 as permitted sender) smtp.mailfrom=dmarc_support@corp.mail.ru<br class="">X-Last-TLS-Session-Version: TLSv1.2<br class="">Authentication-Results: mail.mnin.de;<br class=""><span class="Apple-tab-span" style="white-space:pre"> </span>dkim=pass header.d=corp.mail.ru header.s=mail header.b=k6PdTMpn;<br class=""><span class="Apple-tab-span" style="white-space:pre"> </span>dmarc=pass (policy=reject) header.from=corp.mail.ru;<br class=""><span class="Apple-tab-span" style="white-space:pre"> </span>spf=pass (mail.mnin.de: domain of dmarc_support@corp.mail.ru designates 94.100.178.51 as permitted sender) smtp.mailfrom=dmarc_support@corp.mail.ru<br class=""><br class="">--===============1678280035031557895==<br class="">MIME-Version: 1.0<br class="">Content-Type: text/plain; charset="utf-8"<br class="">Content-Transfer-Encoding: base64<br class=""><br class="">VGhpcyBpcyBhbiBhZ2dyZWdhdGUgcmVwb3J0IGZyb20gTWFpbC5SdS4=<br class=""><br class="">--===============1678280035031557895==<br class="">Content-Type: application/gzip<br class="">MIME-Version: 1.0<br class="">Content-Transfer-Encoding: base64<br class="">Content-Disposition: attachment;<br class=""> filename="mail.ru!mnin.de!1590019200!1590105600.xml.gz"<br class=""><br class="">H4sICM4Kx14C/21haWwucnUhbW5pbi5kZSExNTkwMDE5MjAwITE1OTAxMDU2MDAueG1sAIVTQXKk<br class="">MAy85xW5zSkYqDADW4qzH9jLfsDlscXgCtgu22Szv48MYUJqKpULlpqW6JYFPL9N4/0rhmicfTpU<br class="">RXm4R6ucNvbydJhT/9Aenvkd9Ij6LNULh4DehSQmTFLLJDm4cBFWTsj/SDMWf2dgVwRwIozrSQYl<br class="">4uxz5W/lgi8yXgTirgzAtxSkUM4mqZIwtnd8SMn/YmzA8Upn+XzICBXeVmzajOZ103RlV5+6x+bU<br class="">1ceuax8rQsqqq8sS2CcRyASKIO2F5J7xYizfE1cE0OoFrsrmmOGcA9uXspu5eDca9V/4+TyaOGD+<br class="">lCP9lk/W2EIj1a85SP1iJh6ArQHI6PslzSd4bp0ltucQt5gC8CrxKovJAT1vPheQRp1P949K3RwU<br class="">CuN51bZFXTfF6VRUx5Z6Xd+AcrOlpsDWYLOAr3KcyWu2YKJ30STalg8pewQW/T1dEuGLlexgzRcv<br class="">7LYjW+QZjTaZ3tAichhQagyiD276HNYeBPaFL+c0iIBxHlP80LDNmqrTkBcGw7Ju28gjjqiSC1wT<br class="">g8RtKaxtuJcx5jtdkr2ZHxsr55FPWSa1XZJveq4D+aqdbXfGrj/cO84BW+uiAwAA<br class="">--===============1678280035031557895==--<br class=""></div><div class=""><br class=""></div><div class="">Decompressed xml is:</div><div class=""><br class=""></div><div class=""><?xml version='1.0' encoding='utf-8'?><br class=""><feedback><report_metadata><org_name>Mail.Ru</org_name><email><a href="mailto:dmarc_support@corp.mail.ru" class="">dmarc_support@corp.mail.ru</a></email><extra_contact_info>http://help.mail.ru/mail-help</extra_contact_info><report_id>25590927945792699841590019200</report_id><date_range><begin>1590019200</begin><end>1590105600</end></date_range></report_metadata><policy_published><domain>mnin.de</domain><adkim>r</adkim><aspf>r</aspf><p>none</p><sp>none</sp><pct>100</pct></policy_published><record><row><source_ip>188.225.77.168</source_ip><count>1</count><policy_evaluated><disposition>none</disposition><dkim>fail</dkim><spf>fail</spf></policy_evaluated></row><identifiers><header_from>mnin.de</header_from></identifiers><auth_results><dkim><domain>ninthhelper.ru</domain><selector>dnin</selector><result>pass</result></dkim><spf><domain>ninthhelper.ru</domain><scope>mfrom</scope><result>pass</result></spf></auth_results></record></feedback><br class=""><br class=""></div><div class=""><br class=""></div><div class=""> <div dir="auto" style="color: rgb(0, 0, 0); letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; word-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;" class=""><div style="color: rgb(0, 0, 0); font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px;">Cheers,</div><div style="color: rgb(0, 0, 0); font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px;"><br class=""></div><div style="color: rgb(0, 0, 0); font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px;">Martin</div></div> </div> <br class=""></body></html>