dkim passes under a different domain's dkim

Question

I read that a SPF fail with DKIM pass means someone has forwarded an email with our domain name attached. I haven't sent any emails to this domain. Is this domain trying to send emails with my domain? Can I stop this behavior with a modification that I'm unaware of?

DMARC

v=DMARC1; p=reject; pct=100; aspf=s; adkim=s; sp=reject; rua=mailto:[email]; ruf=mailto:[email]; ri=84600; fo=1; rf=iodef;

SPF

v=spf1 include:[my domain] include:[friend's domain] -all

DMARC Report

  <record>
    <row>
      <source_ip>[redacted]</source_ip>
      <count>1</count>
      <policy_evaluated>
        <disposition>none</disposition>
        <dkim>pass</dkim>
        <spf>fail</spf>
      </policy_evaluated>
    </row>
    <identifiers>
      <header_from>[my domain]</header_from>
    </identifiers>
    <auth_results>
      <dkim>
        <domain>[unauthorized domain]</domain>
        <result>pass</result>
        <selector>[unauthorized subdomain]</selector>
      </dkim>
      <dkim>
        <domain>[my domain]</domain>
        <result>pass</result>
        <selector>[my subdomain]</selector>
      </dkim>
      <spf>
        <domain>[unauthorized domain]</domain>
        <result>pass</result>
      </spf>
    </auth_results>
  </record>

Answer 1

For a full evaluation, it would help if you at least included the unauthorized domain.

I, personally, see this type of result fairly often when someone we send to is using a "cloud" hosted email solution. I send a message to someone at MIT at their @mit.edu email address, but they prefer using their personal Gmail account. On their side, they have set an auto-forward-all rule to send everything to their @gmail.com address.

The kicker is that MIT uses O365 as their email provider. So what I end up seeing is a DMARC report from Google about an email sent out of Outlook.com . Something like:

<identifiers>
  <header_from>[my domain].com</header_from>
</identifiers>
<auth_results>
      <dkim>
        <domain>protection.outlook.com</domain>
        <result>pass</result>
        <selector>s1_dkim.protection.outlook.com</selector>
      </dkim>
      <dkim>
        <domain>[my domain].com</domain>
        <result>pass</result>
        <selector>selector-[city_of_main_office]-01.[my domain].com</selector>
      </dkim>
      <spf>
        <domain>protection.outlook.com</domain>
        <result>pass</result>
      </spf>
</auth_results>

Notice that the report never mentions MIT.edu domain (which is where I sent the message to).

By seeing the passes in this order, along with the header_from still indicating your domain, it is a near 100% likelyhood that this report is talking about an auto-forward rule that someone has in place. Most important for you, is that a spam report against this message would have minimal effect on your domain; by overstamping their DKIM and passing their SPF, the [unauthorized domain] has accepted send responsibility for this message. At this point the inclusion of the DKIM for your domain is more to prove a chain of custody (we forwarded it without editing it) than to prove who is a spammer.