title: DMARC report cconfusion
body: <p>Having trouble interpreting a dmarc report (from Google). Our dmarc policy is currently set to quarantine.</p>
  <blockquote>
  </blockquote>
  <pre><code>  &lt;record&gt;
         &lt;row&gt;
             &lt;source_ip&gt;NOT.OUR.IP.ADDRESS&lt;/source_ip&gt;
             &lt;count&gt;1&lt;/count&gt;
             &lt;policy_evaluated&gt;
                 &lt;disposition&gt;none&lt;/disposition&gt;
                 &lt;dkim&gt;pass&lt;/dkim&gt;
                 &lt;spf&gt;fail&lt;/spf&gt;
             &lt;/policy_evaluated&gt;
         &lt;/row&gt;
         &lt;identifiers&gt;
             &lt;header_from&gt;OUR.DOMAIN&lt;/header_from&gt;
         &lt;/identifiers&gt;
         &lt;auth_results&gt;
             &lt;dkim&gt;
                 &lt;domain&gt;OTHER.DOMAIN&lt;/domain&gt;
                 &lt;result&gt;pass&lt;/result&gt;
                 &lt;selector&gt;default&lt;/selector&gt;
             &lt;/dkim&gt;
             &lt;dkim&gt;
                 &lt;domain&gt;OUR.DOMAIN&lt;/domain&gt;
                 &lt;result&gt;pass&lt;/result&gt;
                 &lt;selector&gt;OUR.SELECTOR&lt;/selector&gt;
             &lt;/dkim&gt;
             &lt;spf&gt;
                 &lt;domain&gt;OTHER.DOMAIN&lt;/domain&gt;
                 &lt;result&gt;pass&lt;/result&gt;
             &lt;/spf&gt;
         &lt;/auth_results&gt;
    &lt;/record&gt;
  </code></pre>
  <p>The OTHER.DOMAIN has an spf record.</p>
  <p>I'm not sure why the auth_results all show pass but spf ultimately fails.  Is this because there was a dkim check for our domain but no spf check?</p>
  <p>Does anyone know what happened here?  Has our domain been spoofed by OTHER.DOMAIN? The IP address matches OTHER.DOMAIN.</p>
  <p>thanks</p>
  <p>j</p>