What could cause a DMARC RUF alert when DKIM/SPF are aligned and DMARC is set to p=none?

Email marketer from MXToolbox mentions that RUF reports indicate a forensic failure, independent of the DMARC policy. The reports are triggered when a message fails SPF and/or DKIM authentication. The 'p=none' setting only affects how the receiving mail server handles the message (acceptance), not whether a failure report is generated.

Email marketer from EmailSecurityBlog explains that the RUF reports provide insight to the specific reasons for authentication failures. The RUF reports can expose misconfigurations in SPF or DKIM, or highlight potential spoofing attempts. Analyze the source IP addresses, the 'From:' header, and the authentication results to understand the root cause.

Marketer from Email Geeks shares that Yahoo does provide Failure reports, but only if the user has one of two particular DMARC reporting platforms with a special feed from them.

Email marketer from EmailGeek explains it could be that your subdomain passing authentication is not aligned with the org domain DMARC record when using `FO=1` which means any failure will send a report.

Email marketer from Mailhardener shares that if the SPF record is failing even though DKIM is passing, it could indicate that the 'MAIL FROM' address used during the SMTP transaction doesn't align with the domain specified in the SPF record, triggering a DMARC failure. Also, if you have set fo=1 it means any failure will send a report - so check this value in the DMARC record. It is important to review the RUF report to understand the exact reason for the failure.

Email marketer from Reddit explains that even with 'p=none', a RUF report can be triggered if the Authentication-Results header shows a DMARC failure. Check the headers to ensure both SPF and DKIM are passing and aligned. Also, investigate the source IP address in the RUF report to identify any potential unauthorized sending sources.

Email marketer from StackOverflow suggests that the issue might stem from the 'From:' header domain not matching the DKIM or SPF domains. Check the alignment modes for DKIM and SPF in your DMARC record. Even if DKIM passes, if the 'From:' domain is different and the alignment is set to strict, it can cause a DMARC failure and trigger a report.

Marketer from Email Geeks explains that there can be many false positives in failure reporting and that some ISPs who provide failure reports don't respect the indicated "fo" tag, leading to confusion.

Expert from Spam Resource explains that even with a DMARC policy of 'p=none', RUF reports are still generated if authentication checks fail. The purpose of 'p=none' is to monitor and gather data without actively rejecting or quarantining messages. It suggests examining the RUF reports to identify the specific reasons for the authentication failures, such as misconfigured SPF or DKIM records or potential spoofing attempts.

Expert from Email Geeks suggests the location of the DMARC record in relation to subdomain vs. the organizational domain is the first place to check when receiving RUF alerts from Yahoo.

Documentation from RFC 7489 explains that RUF reports (forensic reports) are intended for detailed analysis of individual message authentication failures. These are different from aggregate reports and provide message-level information, and generation is not directly tied to the DMARC policy enacted (p=none, quarantine, reject).

Documentation from Google Workspace Admin Help shares that RUF reports are triggered independently of the DMARC policy. Receiving servers may send RUF reports to the address specified in the DMARC record's 'ruf' tag to provide detailed information about authentication failures, helping domain owners identify and address issues.

Documentation from DMARC.org explains that even with a 'p=none' policy, RUF (forensic) reports can still be generated when a message fails DMARC authentication. This is because the 'p=none' policy only dictates how the receiving mail server should treat the message, not whether it should generate reports. RUF reports are triggered by authentication failures, regardless of the policy.