DMARC management

Message forwarding (including mailing lists) would be able to cause something like this.

If you have been sending a message to a mailing list on Google Groups, called “groupname”, Google Groups typically rewrite the envelope from to become something like “[email protected]”, before passing the message on to me.

Since the envelope from @googlegroups.com, that is being SPF checked (likely with the result of SPF pass) is no longer identical to your domain (e.g. @example.com), the alignment will therefore fail.

Certain forwarders (including Cloudflare Email Routing) will do similar kind of envelope from rewriting.

Having a SPF pass is not the same as having a SPF pass with alignment towards the original (header From:) domain, and DMARC actually requires the latter to have a pass within the SPF aligned field.

1 Like