Why is G Suite passing DMARC when alignment fails?

Question

I have a G Suite account with a primary and secondary domains. I have successfully setup DMARC for my primary domain. Now I am trying to setup DMARC for my secondary domain.

SPF is setup for my primary and secondary domains to send from google:

v=spf1 a mx include:_spf.google.com -all

DKIM is also setup for my primary and secondary domains. G Suite is configured for custom DKIM signing (so using my domains, not the gappssmtp.com domain.

DMARC is setup for my primary and secondary domains:

"v=DMARC1; p=none; rua=mailto:xxxx; ruf=mailto:yyyy;"

When I send an email from G Suite, using my secondary domain to another Gmail account, I notice the following:

Observation 1: From: address is correct as my secondary domain:

From: Matt <[email protected]>

Observation 2: DKIM signs using secondary domain correct:

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
        d=secondarydomain.com; s=google;
        h=mime-version:from:date:message-id:subject:to;
        bh=...;
        b=...

Observation 3: SPF passes, but using my primary domain:

Return-Path: <[email protected]>
Received-SPF: pass (google.com: domain of [email protected] designates 209.85.220.41 as permitted sender) client-ip=209.85.220.41;

Observation 4: Gmail marks DMARC as passed:

Authentication-Results: mx.google.com;
       dkim=pass [email protected] header.s=google header.b=r+g2VfEU;
       spf=pass (google.com: domain of [email protected] designates 209.85.220.41 as permitted sender) [email protected];
       dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=secondarydomain.com

My understanding is that DMARC requires DKIM and SPF alignment, meaning From: and Return-Path: headers must both match. From what I can tell, this is not happening.

Why is Gmail reporting DMARC as passed? Incidentally, Outlook.com also reports a pass. However, when I send my email through various DMARC testers, they imply failure since it's not aligned.

Follow-up Question: Anyone know a way to get G Suite to set the Return-Path to my secondary domain when I send emails using my secondary domain?

Update 2020-02-06: Answer to my follow-up question:

I was sending emails from my secondary domain as an alias to my primary domain. The Return-Path will always be the "signed-in user". So in this case, it will always be my primary domain.

To resolve the Return-Path issue, I need to create a user on my secondary domain, and sign-in with that.

However, this still does not answer why Google passes the DMARC.

Answer 1

DMARC requires either SPF or DKIM to produce a PASS result in alignment with the FROM domain.

Please see the RFC for DMARC, section 4.2:

DMARC's filtering function is based on whether the RFC5322.From field domain is aligned with (matches) an authenticated domain name from SPF or DKIM. When a DMARC policy is published for the domain name found in the RFC5322.From field, and that domain name is not validated through SPF or DKIM, the disposition of that message can be affected by that DMARC policy when delivered to a participating receiver.

And also section 6.6.2, step 5:

[...]If one or more of the Authenticated [pass result] Identifiers [SPF or DKIM] align with the RFC5322.From domain, the message is considered to pass the DMARC mechanism check.[...]

In your case, the DKIM check produces a PASS result in alignment with the FROM domain and thus the DMARC check produces a PASS result.