Dmarc: Why do I have dkim=fail, spf=fail and result=pass

Question

I have set up my company dmarc. It is in test mode and I regularly receive reports. Some seem weird to me and I would like to understand. For example, I have received a report with SPF and dkim failed, but the result is passed. I would like to go into prod. But I am not really confident because the result seems unpredictable: Here is a sample of xml record.

<record>
    <row>
        <source_ip>1.2.3.4</source_ip>
        <count>1</count>
        <policy_evaluated>
            <disposition>none</disposition>
            <dkim>fail</dkim>
            <spf>fail</spf>
        </policy_evaluated>
    </row>
    <identifiers>
        <header_from>mydomain.com</header_from>
    </identifiers>
    <auth_results>
        <spf>
            <domain>otherdomain.com</domain>
            <result>pass</result>
        </spf>
    </auth_results>
</record>

My IP 1.2.3.4 sent an email with the from header equal mydomain.com to the domain otherdomain.com.

otherdomain.com considers this email as having valid dmarc.

Here is my config:

<policy_published>
   <domain>mydomain.com</domain>
   <adkim>r</adkim>
   <aspf>r</aspf>
   <p>none</p>
   <sp>none</sp>
   <pct>100</pct>
</policy_published>

My SPF record: mydomain.com text = "v=spf1 ip4:1.2.3.4 ip4:1.2.3.5 ip4:1.2.3.5 ip4:1.2.3.6 ip4:1.2.3.7 ip4:1.2.3.8 ip4:1.2.3.9 ip4:1.2.3.10 ip4:1.2.3.11 include:mydomain.com include:subdomain.mydomain.com -all"

Why is this? I don't understand why it is passing. Can someone explain it to me, please?

Answer 1

TL;TR: someone send a mail with the SMTP envelope of otherdomain.com but the mail header From mydomain.com. Since the SPF check passed for otherdomain.com it might have been someone from otherdomain.com which tried to spoof the sender to mydomain.com.

---

<identifiers>
    <header_from>mydomain.com</header_from>
</identifiers>

This means that the From of the mail shows mydomain.com as the sender domain. This is the domain expected in SPF and DKIM records for identifier alignment.

<auth_results>
    <spf>
        <domain>otherdomain.com</domain>
        <result>pass</result>
    </spf>

This is a successful SPF record. The success of this record is only seen in relation to the SPF specification and not in the context of DMARC as can be seen from RFC 7489 Appendix C:

<!-- This element contains DKIM and SPF results, uninterpreted
    with respect to DMARC. -->
<xs:complexType name="AuthResultType">

Only it the email address in the SMTP dialog ("SMTP envelope") used otherdomain.com. Since otherdomain.com is not mydomain.com the identifier alignment fails and thus:

    <policy_evaluated>
        ...
        <spf>fail</spf>
    </policy_evaluated>

policy_evaluated is the result based on DMARC as can be seen from the specification:

<!-- Taking into account everything else in the record,
     the results of applying DMARC. -->
<xs:complexType name="PolicyEvaluatedType">