I have set up my company dmarc. It is in test mode and I regularly receive reports. Some seem weird to me and I would like to understand. For example, I have received a report with SPF and dkim failed, but the result is passed. I would like to go into prod. But I am not really confident because the result seems unpredictable: Here is a sample of xml record.
<record> <row> <source_ip>18.104.22.168</source_ip> <count>1</count> <policy_evaluated> <disposition>none</disposition> <dkim>fail</dkim> <spf>fail</spf> </policy_evaluated> </row> <identifiers> <header_from>mydomain.com</header_from> </identifiers> <auth_results> <spf> <domain>otherdomain.com</domain> <result>pass</result> </spf> </auth_results> </record>
My IP 22.214.171.124 sent an email with the
from header equal mydomain.com to the domain otherdomain.com.
otherdomain.com considers this email as having valid dmarc.
Here is my config:
<policy_published> <domain>mydomain.com</domain> <adkim>r</adkim> <aspf>r</aspf> <p>none</p> <sp>none</sp> <pct>100</pct> </policy_published>
My SPF record:
mydomain.com text = "v=spf1 ip4:126.96.36.199 ip4:188.8.131.52 ip4:184.108.40.206 ip4:220.127.116.11 ip4:18.104.22.168 ip4:22.214.171.124 ip4:126.96.36.199 ip4:188.8.131.52 ip4:184.108.40.206 include:mydomain.com include:subdomain.mydomain.com -all"
Why is this? I don't understand why it is passing. Can someone explain it to me, please?