Whenever my domain sends a message to a google group on another domain the DMARC alignment fails. This is true for all my approved senders, even using Gmail in my domain. It seems to be because the Return-Path (Envelope From) header is replaced by the receiving group's bounce address, but the From header remains as my domain, which is incorrect.
For example, I send mail from Gmail in my domain, email@example.com, to a group in your domain, firstname.lastname@example.org. If you look at the headers of the message you receive, you see:
Return-Path: <your-group+bncBCA5XFGRYQLCBEHHVS5AKGQED3J2I7I@yourdomain.com> Authentication-Results: mx.google.com; dkim=pass email@example.com; spf=pass (google.com: domain of your-group+bncBCA5XFGRYQLCBEHHVS5AKGQED3J2I7I@yourdomain.com designates 2607:f8b0:400d:c04::246 as permitted sender) smtp.mailfrom=your-group+bncBCA5XFGRYQLCBEHHVS5AKGQED3J2I7I@yourdomain.com; dmarc=fail (p=NONE dis=NONE) header.from=mydomain.com From: Chris <firstname.lastname@example.org> X-Original-Sender: email@example.com X-Original-Authentication-Results: mx.google.com; dkim=pass firstname.lastname@example.org; spf=pass (google.com: domain of email@example.com designates 2607:f8b0:400c:c05::233 as permitted sender) firstname.lastname@example.org; dmarc=pass (p=NONE dis=NONE) header.from=mydomain.com
DMARC fails because of bad alignment between the From domain (mydomain) and the DKIM and SPF domains (yourdomain). However, when you, a properly configured GApps user, send mail from Gmail to a group at mydomain, the headers are different.
Return-Path: <my-group+bncBCGJ3NF22YBRBTXIVS1RKGQEIWR5E6Q@mydomain.com> Authentication-Results: mx.google.com; dkim=pass email@example.com; spf=pass (google.com: domain of my-group+bncBCGJ3NF22YBRBTXIVS1RKGQEIWR5E6Q@mydomain.com designates 2607:f8b0:4001:c0b::247 as permitted sender) smtp.mailfrom=my-group+bncBCGJ3NF22YBRBTXIVS1RKGQEIWR5E6Q@mydomain.com; dmarc=pass (p=NONE dis=NONE) header.from=mydomain.com From: "'You' via my-group" <my-group@ mydomain.com>
Note the different form of the From header - the original sender has been replaced by my own group. There is also a pair of X-Original headers as above that have the same form (just reversed), so I'm not pasting them.
So the question is, how do I configure my domain, gapps, dns, mx, or whatever, so that Google Groups that receive my messages will correctly replace the From header with "via firstname.lastname@example.org ?"
Mail from my domain to users at other domains work fine - DMARC passes because SPF and DKIM are good and the Return-Path still says @mydomain. I have read articles about why the "via you-group" is necessary - I'm ok with that. I'm trying to figure why my messages to groups are not getting treated that way.
Seems to be similar to: How to prevent emails from my domain through mailing lists to be rejected due to DMARC Different because google groups are definitely compatible with DMARC - other people don't have this problem.
Update: I found this article which says google groups only rewrites the sender when the DMARC policy is strict (p=reject). That seems like a terrible idea since the whole point of starting with p=none is to gain confidence that your mail will get delivered when you up the policy, but if true then it may explain my issue. Can anyone confirm? http://www.spamresource.com/2014/04/google-groups-rewriting-from-addresses.html