E-mail forwarding can break SPF, but it should not break DKIM. I want to make a DMARC policy that will evaluate to "pass" when either DKIM or SPF passes, and "fail" when neither DKIM or SPF passes. Is this possible? If so, how is this done?
I'm trying to wrap my head around the result of a DMARC policy evaluation where exactly one of SPF and DKIM fails and one succeeds. I've read RFC7489 and I've found these two quotes:
DMARC evaluation can only yield a "pass" result after one of the underlying authentication mechanisms passes for an aligned identifier.
Final disposition of a message is always a matter of local policy. An operator that wishes to favor DMARC policy over SPF policy, for example, will disregard the SPF policy, since enacting an SPF-determined rejection prevents evaluation of DKIM; DKIM might otherwise pass, satisfying the DMARC evaluation. There is a trade-off to doing so, namely acceptance and processing of the entire message body in exchange for the enhanced protection DMARC provides.
From these quotes, it's not clear what should happen when DKIM succeeds and SPF fails; the evaluation might pass is not something I can base a decision on.