Message header

Question

Authentication-Results	spf=pass (sender IP is 149.72.138.27) smtp.mailfrom=sendgrid.net; dkim=pass (signature was verified) header.d=sendgrid.net;dmarc=none action=none header.from=people.assignmentpro.com;compauth=pass reason=105

DKIM-Signature

v=1; a=rsa-sha256; c=relaxed/relaxed; d=sendgrid.net; h=mime-version:sender:from:subject:content-type: content-transfer-encoding:reply-to:to:cc:content-type:from:subject:to; s=smtpapi; bh=WPNq/nf4yjVVTrsvaDwcV/pmun15yILVAc0vvC4lVR4=; b=RlgM2HUNfkcR+4qtU9PSJjcd2zxaNoL2aq1NdxCeoKgKrzYP7ZsiCgU5HDW5Sx47jIvo y1TD9dN1yQXkNwbD8Mu94aIcuUUtkGYD+P0IaIGrDNzmglWOUfC6IhvqqNM2gZMlxZhUVg CdgIPGfiNAvIYYzpvTeUITn6TPyu7h4/o=

	Sender	<******@people.assignmentpro.com>

	Return-Path	bounces+10258412-c312-hosea.rotich=******@sendgrid.net

Here , DKIM is from sendgrid , smtp mailfrom sendgrid , however from address or sender address is "people.assignmentpro.com" domain. How DMARC can pass.

Answer 1

Hi Microsoft Q & A,

By several researches, you can try to form the DMARC TXT record for your domain in the format:

_dmarc.people.assignmentpro.com 3600 IN TXT "v=DMARC1; p=none; pct=100"

Reference: https://learn.microsoft.com/en-us/microsoft-365/security/office-365-security/email-authentication-dmarc-configure?view=o365-worldwide#set-up-dmarc-for-outbound-mail-from-microsoft-365

---

If the answer is helpful, please click "Accept Answer" and kindly upvote it. If you have extra questions about this answer, please click "Comment". 

Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.

Answer 2

I'm not sure what the previous answer was suggesting, but to the question, the 'C' in DMARC stands for 'Conformance'. This is becasue DMARC requires the 5322.From (the displayed sender address) quotes the same domain as the 5321.MailFrom (the optional sender quoted in the SMTP exchange) and that the message is signed with a DKIM key in the same domain. Setting a DMARC policy in <people.assignmentpro.com> or <assignmentpro.com> will not overcome this fact. Hence the answer to your question: "How DMARC can pass" ... the answer is it cannot.

This highlights a common DMARC issue that people see they are recording an SPF or DKIM pass and cannot understand why mail is failing DMARC. Domain non-conformance is often the issue.

As an extra note, there are attributes in the DMARC record as to whether the alignment is relaxed (simply the same domain) or strict (identical FQDN) ... align SPF: aspf=r for relaxed, s for strict and align DKIM: adkim=r relaxed and strict as before.