I have a G Suite account with a primary and secondary domains. I have successfully setup DMARC for my primary domain. Now I am trying to setup DMARC for my secondary domain.
SPF is setup for my primary and secondary domains to send from google:
v=spf1 a mx include:_spf.google.com -all
DKIM is also setup for my primary and secondary domains. G Suite is configured for custom DKIM signing (so using my domains, not the
DMARC is setup for my primary and secondary domains:
"v=DMARC1; p=none; rua=mailto:xxxx; ruf=mailto:yyyy;"
When I send an email from G Suite, using my secondary domain to another Gmail account, I notice the following:
From: address is correct as my secondary domain:
From: Matt <email@example.com>
Observation 2: DKIM signs using secondary domain correct:
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=secondarydomain.com; s=google; h=mime-version:from:date:message-id:subject:to; bh=...; b=...
Observation 3: SPF passes, but using my primary domain:
Return-Path: <firstname.lastname@example.org> Received-SPF: pass (google.com: domain of email@example.com designates 184.108.40.206 as permitted sender) client-ip=220.127.116.11;
Observation 4: Gmail marks DMARC as passed:
Authentication-Results: mx.google.com; dkim=pass firstname.lastname@example.org header.s=google header.b=r+g2VfEU; spf=pass (google.com: domain of email@example.com designates 18.104.22.168 as permitted sender) firstname.lastname@example.org; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=secondarydomain.com
My understanding is that DMARC requires DKIM and SPF alignment, meaning
Return-Path: headers must both match. From what I can tell, this is not happening.
Why is Gmail reporting DMARC as passed? Incidentally, Outlook.com also reports a pass. However, when I send my email through various DMARC testers, they imply failure since it's not aligned.
Follow-up Question: Anyone know a way to get G Suite to set the
Return-Path to my secondary domain when I send emails using my secondary domain?
Update 2020-02-06: Answer to my follow-up question:
I was sending emails from my secondary domain as an alias to my primary domain. The
Return-Path will always be the "signed-in user". So in this case, it will always be my primary domain.
To resolve the
Return-Path issue, I need to create a user on my secondary domain, and sign-in with that.
However, this still does not answer why Google passes the DMARC.