Tero Kivinen writes:
> > What are those 0.75%, some 30k SPF - DKIM messages? Are there
> > cases of DKIM random failure salvaged by SPF?
>
> My current analysis script does not try to calculate that, I would
> need to need to add that step there and rerun the script. If I
> understand correctly you would like to see cases where if there is
> both SPF and DKIM, the cases where the both, only one, or neither
> passed, and how many of those cases would be where dkim=fail, but
> spf=pass?
I rerun the statistics and yes, there is 0.84% cases where dkim
failed, but spf returned eithe pass, softfail or neutral.
There was also 1.12% cases where spf returned permerror but dkim
returned pass, and 1.26% cases where dkim returned pass and spf
returned fail, or softfail.
There is of course much bigger part of emails where there was no dkim,
but there was spf that passed (7.03%) or softfailed (1.08%).
Here are the actual numbers for DKIM and SPF result combinations:
DKIM & SPF combinations
===========================================
78.62% 3133749 dkim=pass,spf=pass
7.03% 280239 dkim=none,spf=pass
4.68% 186634 dkim=pass,spf=none
3.85% 153543 dkim=none,spf=none
1.12% 44543 dkim=pass,spf=permerror
1.08% 43212 dkim=none,spf=softfail
0.82% 32821 dkim=fail,spf=pass
0.78% 30953 dkim=pass,spf=softfail
0.61% 24221 dkim=none,spf=fail
0.48% 19329 dkim=pass,spf=fail
0.43% 17120 dkim=none,spf=neutral
0.24% 9612 dkim=fail,spf=none
0.06% 2320 dkim=none,spf=permerror
0.06% 2214 dkim=pass,spf=neutral
0.04% 1712 dkim=none,spf=temperror
0.02% 995 dkim=fail,spf=fail
0.02% 924 dkim=fail,spf=softfail
0.02% 669 dkim=temperror,spf=pass
0.01% 360 dkim=missing,spf=missing
0.00% 199 dkim=temperror,spf=temperror
0.00% 196 dkim=fail,spf=neutral
0.00% 144 dkim=missing,spf=none
0.00% 119 dkim=pass,spf=temperror
0.00% 99 dkim=missing,spf=pass
0.00% 50 dkim=fail,spf=permerror
0.00% 38 dkim=missing,spf=softfail
0.00% 14 dkim=temperror,spf=none
0.00% 10 dkim=temperror,spf=softfail
0.00% 7 dkim=missing,spf=fail
0.00% 6 dkim=fail,spf=temperror
0.00% 6 dkim=missing,spf=neutral
0.00% 1 dkim=temperror,spf=fail
0.00% 1 dkim=missing,spf=temperror
I.e. 78.64% of time both DKIM and SPF passed.
I also calculated statistics for all DKIM, SPF, DMARC, and ARC
combinations, but there were so many of them that I do not include the
full list here but here is top 30 from that list:
Protocol combinations
============================================================
37.74% 1504477 dkim=pass,spf=pass,dmarc=missing,arc=missing
25.37% 1011277 dkim=pass,spf=pass,dmarc=pass,arc=missing
10.96% 436838 dkim=pass,spf=pass,dmarc=none,arc=missing
3.46% 138083 dkim=none,spf=pass,dmarc=missing,arc=missing
2.15% 85799 dkim=pass,spf=none,dmarc=missing,arc=missing
2.00% 79739 dkim=pass,spf=none,dmarc=pass,arc=missing
1.96% 78279 dkim=none,spf=none,dmarc=missing,arc=missing
1.64% 65205 dkim=none,spf=pass,dmarc=none,arc=missing
1.60% 63758 dkim=pass,spf=pass,dmarc=missing,arc=pass
1.54% 61579 dkim=none,spf=pass,dmarc=pass,arc=missing
1.16% 46309 dkim=pass,spf=pass,dmarc=pass,arc=pass
1.09% 43529 dkim=none,spf=none,dmarc=fail,arc=missing
0.92% 36478 dkim=pass,spf=pass,dmarc=fail,arc=missing
0.79% 31298 dkim=none,spf=none,dmarc=none,arc=missing
0.56% 22504 dkim=none,spf=softfail,dmarc=missing,arc=missing
0.56% 22123 dkim=pass,spf=permerror,dmarc=missing,arc=missing
0.55% 21973 dkim=pass,spf=pass,dmarc=none,arc=pass
0.40% 15760 dkim=fail,spf=pass,dmarc=missing,arc=missing
0.37% 14855 dkim=none,spf=softfail,dmarc=fail,arc=missing
0.37% 14716 dkim=pass,spf=softfail,dmarc=missing,arc=missing
0.34% 13576 dkim=none,spf=fail,dmarc=missing,arc=missing
0.32% 12745 dkim=pass,spf=permerror,dmarc=none,arc=missing
0.31% 12348 dkim=pass,spf=softfail,dmarc=pass,arc=missing
0.26% 10290 dkim=none,spf=neutral,dmarc=missing,arc=missing
0.24% 9657 dkim=pass,spf=permerror,dmarc=pass,arc=missing
0.23% 9367 dkim=pass,spf=fail,dmarc=missing,arc=missing
0.20% 8121 dkim=pass,spf=fail,dmarc=pass,arc=missing
0.20% 7785 dkim=fail,spf=pass,dmarc=none,arc=missing
0.17% 6719 dkim=pass,spf=none,dmarc=missing,arc=pass
0.16% 6248 dkim=none,spf=pass,dmarc=fail,arc=missing
So 37% emails had dkim and spf pass, but no dmarc. 25.37% had also
dmarc.
--
kivi...@iki.fi
_______________________________________________
dmarc mailing list
dmarc@ietf.org
https://www.ietf.org/mailman/listinfo/dmarc
