I have recently moved some of my e-mail services to sub-domains (sub1.company.com, sub2.company.com) because the SPF of the main domain - company.com got full (lot's of includes and there is more relevant stuff there). Also, each of my subdomains have different SPF (third party companies and so on).
Now a very interesting thing I have noticed just a while ago is that even though my subdomain sub1.company.com has the SPF configured:
sub1.company.com 599 IN TXT "v=spf1 ip4:IP_OF_3RD_PARTY -all"
I still receive reports saying that I did not pass the SPF check! Here is a real life example:
A message claiming to be from you has failed the published DMARC policy for your domain. Sender Domain: company.com Sender IP Address: IP_OF_3RD_PARTY Received Date: Fri, 31 Jul 2015 14:44:29 +0000 SPF Alignment: no DKIM Alignment: no DMARC Results: Quarantine
Why the heck do they say I have sent an email from company.com if I sent it from sub1.company.com??? What is going on over here?
Also , the DKIM does not look okay:
Authentication-Results: m.*****.com; dkim=invalid header.d=company.com
Why does the header say it comes from company.com instead of sub1.company.com? Is that the 3-rd party company fault that they put it there or whose server generates it?