Do I need to tune my DMARC settings (SPF align failure at final delivery)?

I've received my first (ever!) DMARC forensic report, and I'm not sure if it implies I should be setting something differently, or if this is desired behavior, or if it's undesired but there's nothing to be done.

The actual report says

Feedback-Type: auth-failure
User-Agent: szn-mime/2.0.46
Version: 1
Original-Mail-From: [email protected]
Original-Rcpt-To: [email protected]
Source-Ip: 2a00:1450:4864:20::348
Reported-Domain: cwrichardson.com
Authentication-Results: email.seznam.cz 1;
    spf_align=fail;
    dkim_align=pass
Delivery-Result: delivered

Looking at the returned headers, I guess there's some internal forwarding/aliasing happening between where I sent the email (@skolaseiferta.cz) and the recipient's actual email address (@seznam.cz). There's a bunch of stuff in the middle from Google where it looks like everything (SPF, DKIM, DMARC) is passing. I have vague recollections that I've read somewhere that sometimes Google forwards without updating the headers and this causes problems. Maybe that's what's happening here, but my core question is, is this failure (SPF alignment; but message delivered) an indication that I have something configured wrong, and if so, what should I change?

Here's the final header as reported back in the forensic report:

Received-SPF: pass (google.com: domain of [email protected] designates 54.93.189.174 as permitted sender) client-ip=54.93.189.174;
From: Christopher Richardson <[email protected]>
Message-Id: <[email protected]>
Content-Type: multipart/alternative;
    boundary="Apple-Mail=_4FC50147-75FE-4FDF-B8EC-F651F9EF7F63"
Mime-Version: 1.0 (Mac OS X Mail 14.0 \(3654.60.0.2.21\))
Subject: =?utf-8?B?UmU6IMWha29sYSB2IHDFmcOtcm9kxJs=?=
Date: Wed, 21 Apr 2021 21:27:56 +0200
In-Reply-To: <[email protected]>
Cc: Sarah Richardson <[email protected]>,
[email protected]
To: [email protected]
References: <CAOSANHi3e3EPsdvvBU5sh_r3T5h+m8+4Mmwsek=ZxHj3rmEaZQ@mail.gmail.com>
<[email protected]>
X-Mailer: Apple Mail (2.3654.60.0.2.21)
Delivered-To: [email protected]: Wed, 21 Apr 2021 21:28:10 +0200 (CEST)
Reporting-MTA: dns; email.seznam.cz

Final-Recipient: rfc822; [email protected]
Status: 2.0.0
Diagnostic-Code: x-uknown;
Action: x-unknown
Original-Recipient: rfc822; [email protected]

To achieve DMARC compliance, either SPF or DKIM must be aligned. ~~So I do not understand why you did get this forensic report - as far as I understand the DMARC system, this message is comliant, since DKIM passed the alignment test~~ As far as I see, the message is DMARC compliant - normally you would not get a forensic report, but there is a setting that requests reports even if any of the mechanisms fail (thanks @anx for this information - was new to me!). This report also tells you in the last line that the message was delivered - so no rejection or quarantining here.

Forwarding is a known problem of DMARC, because sender addresses in the header could missmatch. Normaly if a mail gateway detects a mail that is not DMARC compliant and "looks forwarded" due to specific hints in the header, the gateway could let this mail through - even if SPF and DKIM are failing - see DMARC Policy Overrides.

Do I need to tune my DMARC settings (SPF align failure at final delivery)?

Related

Recent Posts