Gmail silently discards forwarded email for sender domains with SPF record "-all"

[n5bb]

Peter, the SPF records of the sender From header domain (nyheder.bilka.dk) is basically:

v=spf1 include:emarsys.net include:emsmtp.com ~all

So SPF specifies softfail. The DMARC record is:

v=DMARC1; p=reject; adkim=s; aspf=r; rf=afrf; pct=100;

So DMARC requests rejection (which may mean silently discarding) such messages if both SPF and DKIM fail. We can't tell if the message was properly forwarded with SRS (allowing SPF to pass) or if DKIM passed when received at Gmail.

But this is a message from a bulk marketing company, and the Fastmail global Bayes score is already 50%. Gmail may be rating that message much worse based on user reports or other criteria and discarding the message as too spammy. Was the From address or From domain (nyheder.bilka.dk) whitelisted in the Gmail account? I don't think you can expect 100% delivery of messages from a bulk sender with a significant spam score (at least from SpamAssassin) which are then forwarded. This SpamAssassin tag also is of concern: MIME_HTML_ONLY

[lane]

Originally Posted by n5bb

We can't tell if the message was properly forwarded with SRS (allowing SPF to pass) or if DKIM passed when received at Gmail.

I believe DMARC insists that SPF pass on the From: header in order for SPF to be considered as passing. If Fastmail is set to SRS, SPF should pass on the Return-Path: header (envelope sender) but that does not generate a pass for SPF, since that requires it pass on the From: header. It might be better if Fastmail is set to not use SRS, forwarding will probably cause a softfail for this vendor (using ~all), and I am not sure how Google will treat that as far as spam purposes are concerned.

[n5bb]

I have DMARC DNS records for my personal domain, and can verify that Fastmail alias targeting of a Gmail account (with SRS enabled) passes SPF and DKIM. Here are the munged received headers at my Gmail account:

Received-SPF:
      pass (google.com: domain of SRS0=sBhS=WJ=mydomain.com=bill@srs.messagingengine.com designates 66.111.4.26 as permitted sender) client-ip=66.111.4.26;
Authentication-Results: mx.google.com;
      spf=pass (google.com: domain of SRS0=sBhS=WJ=mydomain.com=bill@srs.messagingengine.com designates 66.111.4.26 as permitted sender) smtp.mail=SRS0=sBhS=WJ=mydomain.com=bill@srs.messagingengine.com; 
      dkim=pass header.i=@mydomain.com;
      dmarc=pass (p=NONE dis=NONE) header.from=mydomain.com

My guess is still that something else (spam markers, sending address or domain, or some IP address) is causing Gmail to consider this as spam.