That graph is awful, especially how it's conflating those three things. My guess (I don't know much about the postmaster tools), is that SPF is only judging what has an envelope sender for your domain, DKIM is only judging what has a DKIM signature, and DMARC is judging what is "From" your domain.
Given that is has "dmarc" on it, you'd think the graph would be about dmarc and alignment, and the three lines would all be judged on the same messages, but I'm guessing it's not. Ie, you'd think it was all messages >From your domain, and then the dmarc output would match where spf and dkim failed. My guess is what you're seeing is because you're p=none, and so some of your messages which have your From domain are being sent through GSuite mailing lists (which are used for most GSuite aliases like sa...@gsuitecustomer.com, so quite common), and because you're p=none, we don't rewrite the From, and we do remove the DKIM signature (since it would be broken) and the envelope sender will be the list (so not affecting your SPF). This will likely be what you find in your dmarc aggregate report. If you were to go p=quarantine or reject, GSuite Groups would start rewriting the from and the dmarc failures would likely go down or away for you. Brandon On Thu, Oct 5, 2017 at 4:24 AM, Roland Turner via dmarc-discuss < dmarc-discuss@dmarc.org> wrote: > Is the information in this graph consistent with what's in Google's > aggregate feedback? (This is to determine whether Google's DMARC > implementation is broken, or just the postmaster tool.) > > - Roland > > > > On 05/10/17 18:51, The Venus Project Postmaster via dmarc-discuss wrote: > > Hi everyone, > > For the past several months we have been experiencing ups and downs in our > DMARC authentication with Gmail, as seen from Google's postmaster tool (see > attached screenshot). DKIM and SPF authentication are consistently at 100%, > but DMARC authentication varies wildly, although there have been no > configuration changes on our side. > > Our DMARC DNS record seems to be set up properly. > > Some time ago I contacted the Google postmaster team through their > feedback form, but nothing followed. > > Does anyone have any suggestions on what could be causing this (could it > be anything on our end?) and what we could do to resolve it? > > Thanks in advance, > Borislav > The Venus Project Postmaster Team > www.thevenusproject.com > > > _______________________________________________ > dmarc-discuss mailing > listdmarc-discuss@dmarc.orghttp://www.dmarc.org/mailman/listinfo/dmarc-discuss > > NOTE: Participating in this list means you agree to the DMARC Note Well terms > (http://www.dmarc.org/note_well.html) > > > > _______________________________________________ > dmarc-discuss mailing list > dmarc-discuss@dmarc.org > http://www.dmarc.org/mailman/listinfo/dmarc-discuss > > NOTE: Participating in this list means you agree to the DMARC Note Well > terms (http://www.dmarc.org/note_well.html) >
_______________________________________________ dmarc-discuss mailing list dmarc-discuss@dmarc.org http://www.dmarc.org/mailman/listinfo/dmarc-discuss NOTE: Participating in this list means you agree to the DMARC Note Well terms (http://www.dmarc.org/note_well.html)
