DMARC rua indicates mail send from competitorDomain.com for ourDomain.com, is this (potentially) mallicous?

Question

We've received several rua reports indicating that one of our direct competitors is sending emails with our domain in the mail from headers.

I do not have access to the actual emails sources, and I have no idea what would cause this. The one cause I can think of is that somebody at the competitors company is sending out emails on our behalf (a conclusion I hope we can discredit).

Relevant rua report section:

<?xml version="1.0" encoding="UTF-8" ?>
<feedback>
  (...)
  <record>
    <row>
      <source_ip>209.85.220.69</source_ip><!-- mail-sor-f69.google.com -->
      <count>2</count>
      <policy_evaluated>
        <disposition>none</disposition>
        <dkim>fail</dkim>
        <spf>fail</spf>
        <reason>
          <type>local_policy</type>
          <comment>arc=pass</comment>
        </reason>
      </policy_evaluated>
    </row>
    <identifiers>
      <header_from>[our domain].com</header_from>
    </identifiers>
    <auth_results>
      <dkim>
        <domain>[competitor domain]-com.20150923.gappssmtp.com</domain>
        <result>pass</result>
        <selector>20150923</selector>
      </dkim>
      <spf>
        <domain>[competitor domain].com</domain>
        <result>pass</result>
      </spf>
    </auth_results>
  </record>
</feedback>

So, my question is:
What can cause this to happen? Is there normal behaviour that could cause these reports? Is this the result of legitimate email traffic? or is this an indication of malicious behaviour somewhere?

_{Side note
I'm unsure what the section means.}

  (...)
  <reason>
    <type>local_policy</type>
    <comment>arc=pass</comment>
  </reason>
(...)

_{Reading up on DMARC `arc` leads me to suspect it may be caused by email forwarding but `arc` should make sure the DKIM headers would still be available for authentication? In which case the forwarded email should not `fail` the DMARC policy?}

Answer 1

If you're sure that all of your legit mail passes DMARC, including the header FROM domain (example.com) and MAIL FROM (Envelope FROM) domain, something like em.example.com are in alignment, that is, both have example.com as the organizational domain, then you could try a more aggressive DMARC policy to p=quarantine (asks mailbox providers to route non authentic mail to spam) or p=reject (asks mailbox providers to reject any mail that's not authenticated).

Do you know about many emails per week that aren't passing DMARC, say, from this competitor go out? Are any of your email streams, ones that you send failing DMARC? Are any of your own mail streams that are failing DMARC OR SPF?

It's important to be very careful when moving to a more aggressive DMARC policy but if someone seems to be spoofing your domain, then you might consider cutting that off.

Do you feel comfortable calling this competitor or otherwise asking them if there's some misconfiguration on their side whereby they are mistakingly using your domain?

Answer 2

1. DKIM pass for [competitor domain]-com.20150923.gappssmtp.com. This means that Google's SMTP servers have the private key for the DKIM selector 20150923 at [competitor domain]-com.20150923.gappssmtp.com. AFAIK this is only possible if [competitor domain].com is hosted by Google Workspace which, in turn, needs to go through a validation process that can be completed only by the domain owner
2. SPF pass for [competitor domain].com, and this mean that your competitor authorizes the sender server (Google). Again, this can only be set up by the domain owner
3. <header_from> has your domain

This is strong evidence that, yes, your competitor tried to send two emails using your domain.