SPF + DKIM pass and DMARC fails

Question

The domain s****g.nl has the following DMARC record:

"v=DMARC1; p=reject; rua=mailto:postmaster@s****g.nl, mailto:dmarc@s****g.nl"

A valid SPF record for the sending mail server and none DKIM record.

The domain fo***de.com has a valid SPF and DKIM record.

Example 1

From: from@s****g.nl
To: thetoadres@mail.com

Result:

SPF: PASS
DKIM: FAIL
DMARC: PASS

Example 2

From: from@s****g.nl
Sender: response@fo***de.com
To: thetoadres@mail.com

Result:

SPF: PASS
DKIM: PASS
DMARC: FAIL

So when I send the email using a sender (on behalf of) the DMARC fails and the mail is not delivered.

Is there a explanation for this and maybe a solution to send emails on behalf of a domain which contains a DMARC reject policy and have a valid SPF for the sending mailserver?

Edit:

[Screenshot results...][1]

DMARC without DKIM doesn't make much sense? What does something like [dmarcian.com](https://dmarcian.com) make of your setup? — Synchro, Oct 12 '16 at 10:39

score 12 · Accepted Answer · edited Oct 29 '21 at 16:53

12

I have a feeling, it's failing on your ADKIM and ASPF Tests of DMARC. If SPF and DKIM passes, then it must be failing on both alignment tests.

Read this to understand more about Identifier Alignments

I seen several cases where there DKIM Validator is coded wrong and it will fail DMARC when it fails 1 alignment test, but both must fail according to the RFC Standards.

The only alignment tester I know about is this email tester, if you post the full headers of the sent emails. It'll be much easier to understand what might be wrong. You're only sharing part of the information and it's impossible to make a 100% accurate assessment. But I'm 80% confident the issue is with the alignment.

Based on the image you linked of your headers, I added an "a" to the beginning and "1" to the end so bots don't spam you.

Return-Path = response@afo***de1.com
DKIM Signature = d=afo***de1.com
From = info@as**g1.nl

So for ADKIM alignment to Pass the "from" domain must match the "d=" domain of the dkim signature

info@as**g1.nl <> afo***de1.com

For the ASPF Alignment to pass the "return-path" domain must match the "from" domain

afo***de1.com <> as**g1.nl

One of those need to match in order for DMARC to pass.

edited Oct 29 '21 at 16:53

Phil Dukhov

67,741
15
184
220

answered Oct 12 '16 at 13:48

Henry

2,953
2
21
34

See the mail headers below: – Stefan Groenewoud Oct 12 '16 at 14:54
Yes that's the issue, you fail on both ADKIM and ASPF after looking at your headers. They do not align. Please mark my answer as correct :) – Henry Oct 12 '16 at 15:58
Henry, how can I fix this? Changing the headers? Please Let me know :) – Stefan Groenewoud Oct 12 '16 at 17:04
I updated my answer to make it more clear on what you need to do to fix it. – Henry Oct 12 '16 at 18:24
The sender and the from address aren't the same. Does the SPF record allow the from address in the record? – timkly Nov 30 '16 at 02:17
The SPF Record Compares the Domain in the "Return-Path" and makes sure the mail server that sent the email is authorized to do so. – Henry Nov 30 '16 at 02:24
https://email-test.had.dnsops.gov/ will test the alignment – MeSo2 Oct 25 '21 at 17:38

SPF + DKIM pass and DMARC fails

1 Answers1