I have set up DMARC for some months now and I am using dmarc-visualizer to parse the reports.
Overall I am happy so we can advance towards BIMI, but before switching to quarantine or reject on DMARC, there is a behavior that I cannot understand.
My company is named ABC (for the sake of the example) and we are working with quite a number of contractors/third parties, let's pick one named XYZ
Issue: I notice in the DMARC reports several mails sent using our domain ABC (header_from) but with DKIM & SPF from XYZ. Upon contact XYZ told me that they are not sending mails on our behalf. In fact I contacted several different contractors on which we have the same issue, but the answers was the same.
Question: Have you an explanation? According to the documentation. DKIM should not change when mails are forwarded (unlike SPF), so it should not be an issue with forwarding. no?
v=DMARC1; p=none; adkim=s; rua=mailto:DMARC-Feedback@abc.com; ruf=mailto:DMARC-Feedback@abc.com; fo=d;
<record> <row> <source_ip>IP_FROM_XYZ_MAILSERVER</source_ip> <count>1</count> <policy_evaluated> <disposition>none</disposition> <dkim>fail</dkim> <spf>fail</spf> </policy_evaluated> </row> <identifiers> <header_from>ABC.com</header_from> </identifiers> <auth_results> <dkim> <domain>XYZ.fr</domain> <result>pass</result> <selector>s1XXX</selector> </dkim> <spf> <domain>XYZ.fr</domain> <result>pass</result> </spf> </auth_results>