Three messages, one DMARC failure
Read Authentication-Results in a mailbox export and explain each verdict: a forwarded list mail that fails SPF but passes DMARC, and a “partner” invoice that passes SPF but fails DMARC.
Briefing
DMARC passes if either SPF or DKIM passes and is aligned with the From domain. SPF can pass for the wrong domain, and SPF can fail for a legitimate message that was forwarded.
The finance team’s quarantine export holds three messages that mention partner.example or vendor.example.
mail-triage · Email and phishing
Type help for the command list and objectives for your tasks. Everything runs in this browser.
Up and down arrows walk your history. Ctrl+L clears the screen. Try help, ls, and objectives.