We host our own e-mail but use Sendgrid to send mail on behalf of a few internal PHP services that can't easily handle our mail configuration (e.g. they disallow self-signed certs by default, so getting them to connect to our server to send out things like account activation e-mails is a PITA, like to the point of having to hack the functions of a CMS to pass in an array of config overrides - for the handful of emails this would be, I thought the heck with it and just used Sendgrid's free tier).
I was able to set up our SPF to explicitly allow Sendgrid to send emails on our behalf:
ourdomain.com. IN TXT "v=spf1 mx a ip4:OUR.IP.GOES.HERE/32 include:sendgrid.net -all"
And so there are parallel paths for both mail sent by us and mail sent by Sendgrid to pass both SPF and DKIM. (I didn't do anything special setting up DKIM for ourselves, but it was a bit of a process - FWIW, here's the tutorial I followed.)
But now I want to wrap everything up with DMARC, and Sendgrid emails are failing, even though they pass SPF and DKIM:
dkim=pass firstname.lastname@example.org header.s=smtpapi header.b=eI2rawkZ;
spf=pass (google.com: domain of email@example.com designates SENDGRID.IP.GOES.HERE as permitted sender) smtp.mailfrom="firstname.lastname@example.org";
dmarc=fail (p=NONE sp=NONE dis=NONE) header.from=ourdomain.com
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=sendgrid.net; h=from:subject:content-type:content-transfer-encoding:mime-version: x-feedback-id:to; s=smtpapi; bh=AZ+8LE7VkXTKxox/rLn7opOhEWv+baJWKr9E5fUOSKs=; b=eI2rawkZeMvtcJXThu7pufwbVPjRHa5xx46txJj0j9gNNDxNs68y8bcPlj1T9r7rxDK4 oi6e19GMvtdyttXR5WKjg2T+w0p5Ep3Ni6YRQhxq4ZsGcO0mZiRXyNf4BdZ3cOgLKXwECh dMSOaHyK0lR91Xp6eTnOYE7bT9hcRVrWA=
E-mail sent by us is passing:
dkim=pass email@example.com header.s=default header.b=fySBSueO;
spf=pass (google.com: domain of firstname.lastname@example.org designates OUR.IP.GOES.HERE as permitted sender) email@example.com;
dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=ourdomain.com
Our DMARC record is set up like this:
_dmarc.ourdomain.com. 299 IN TXT "v=DMARC1\; p=none\; pct=100\; rua=mailto:firstname.lastname@example.org"
Is there a way we can adjust our DNS (or something else?) to permit Sendgrid e-mails to pass the DMARC check? Then we could safely up the recommended 'p' action to 'quarantine' or 'reject'. Although, if it wouldn't be a great drain on our reputation, I'd be happy to leave it at 'none'. It would just be nice to get everything all neatly tied-up, following on from the difficulties I was having before I embarked on the SPF / DKIM / DMARC journey.