==== REQUIRED BASIC INFO OF YOUR IREDMAIL SERVER ====
- iRedMail version (check /etc/iredmail-release): 1.0
- Deployed with iRedMail Easy or the downloadable installer? dl
- Linux/BSD distribution name and version: deb10
- Store mail accounts in which backend (LDAP/MySQL/PGSQL): my
- Web server (Apache or Nginx):
- Manage mail accounts with iRedAdmin-Pro?
- [IMPORTANT] Related original log or error message is required if you're experiencing an issue.
====

Hi,

I need your help, I don't know if I misconfigured something, or it's just how DMARC works, anyway this is beyond my knowledge.

When the recipient auto-forwards the mail to gmail, DMARC fails.

My dns records:

mydomain.com    1800    MX    10 mx.mymaildomain.com
mydomain.com    1800    TXT    v=spf1 mx ~all
mydomain.com    1800    TXT    v=DMARC1; p=reject; rua=mailto:postmaster@mydomain.com; ruf=mailto:postmaster@mydomain.com
dkim._domainkey.mydomain.com    1800    TXT    v=DKIM1; p=...

I use the same DKIM record for all of my domains:

dkim_key('mymaildomain.com', 'dkim', '/var/lib/dkim/mymaildomain.com.pem');
@dkim_signature_options_bysender_maps = ({
    '.' => {d => 'mymaildomain.com',
            a => 'rsa-sha256',
            c => 'relaxed/simple',
            ttl => 30*24*3600 },
});

The google report for the PASSED (I posted this because there's already a dkim fail):

<record>
    <row>
        <source_ip>my.ip</source_ip>
        <count>30</count>
        <policy_evaluated>
            <disposition>none</disposition>
            <dkim>fail</dkim>
            <spf>pass</spf>
        </policy_evaluated>
    </row>
    <identifiers>
        <header_from>mydomain.com</header_from>
    </identifiers>
    <auth_results>
        <dkim>
            <domain>mymaildomain.com</domain>
            <result>pass</result>
            <selector>dkim</selector>
        </dkim>
        <spf>
            <domain>mydomain.com</domain>
            <result>pass</result>
        </spf>
    </auth_results>
</record>

With the forwarded messages, SPF softfails, so DMARC rejects:

  <record>
    <row>
      <source_ip>not.my.ip</source_ip>
      <count>1</count>
      <policy_evaluated>
        <disposition>reject</disposition>
        <dkim>fail</dkim>
        <spf>fail</spf>
      </policy_evaluated>
    </row>
    <identifiers>
      <header_from>mydomain.com</header_from>
    </identifiers>
    <auth_results>
      <dkim>
        <domain>mymaildomain.com</domain>
        <result>pass</result>
        <selector>dkim</selector>
      </dkim>
      <spf>
        <domain>mydomain.com</domain>
        <result>softfail</result>
      </spf>
    </auth_results>
  </record>

thanks
adam