DMARC <policy_evaluated> SPF fails when using PostSRSD

Question

I am running a mailserver under example.com that serves emails for a couple of domains. As my server does not have a mailbox, all the emails it receives are forwarded to particular Gmail accounts. To prevent the SPF from these emails from becoming softfail, I installed PostSRSD to rewrite the mail header so that all of the forwarded mail comes from example.com and the SPF passes.

Now, when I look at the message source for my emails (across all my hosted domains), everything looks great. All forwarded mails pass SPF and DKIM. But when the DMARC report for my virtual (non-example.com) domains come back, I get this:

<policy_evaluated>
    <disposition>none</disposition>
    <dkim>pass</dkim>
    <spf>fail</spf>
</policy_evaluated>

A Google search tells me that the SPF fails because of the PostSRSD rewrite. But in <auth_results>, the SPF record is checked against example.com (despite it being a DMARC record for, say domain.com) and it passes!

<auth_results>
    <dkim>
        <domain>domain.com</domain>
        <result>pass</result>
        <selector>mail</selector>
    </dkim>
    <spf>
        <domain>example.com</domain>
        <result>pass</result>
    </spf>
</auth_results>

If I leave my PostSRSD configuration as it is (i.e. emails from domain.com sent from my mailserver continues to be rewritten to example.com emails), I am concerned that it will affect my mailserver's IP reputation. Will it? If it does, I will have to mess around with PostSRSD to not rewrite my virtual hosted domains.

Answer 1

What is the DMARC policy on the virtual domains? If they include aspf=r or aspf=s then SPF must be based on a domain that is either the same as theirs or related to it (in a subdomain). So although an SPF check can pass, if there's no aligment of domains from DMARCs point of view it's a failure.