This is an odd one:
<record> <row> <source_ip>126.96.36.199</source_ip> <count>2</count> <policy_evaluated> <disposition>none</disposition> <dkim>pass</dkim> <spf>fail</spf> </policy_evaluated> </row> <identifiers> <header_from>mydomain.co.uk</header_from> </identifiers> <auth_results> <dkim> <domain>mydomain.co.uk</domain> <result>pass</result> </dkim> <spf> <domain>mydomain.co.uk</domain> <result>fail</result> </spf> </auth_results> </record>
I use a combination of my own servers and google to send mail. The source IP is not one of mine or one of Google's - how they hell can DKIM pass?
The reports come from Yahoo. The IP appears to be a mail server for btinternet.com managed by cpcloud.co.uk (Critical Path Inc.) - i know there was some oddness between them in the past with SPF etc. - could it be something to do with that?
The IP is only in the Yahoo DMARC reports. The dates I get the reports are 1 day ahead of emails that were sent to btinternet users.
Is it as simple as i'm sending an email to a bt account, it's getting forwarded/redirected/resent to yahoo and that's flagging the fail?