I've got an issue with my email setup where we've got "domain1.com" hosted on Exchange and "domain2.com" on Google Workspace, with connectors between the two. When someone from "domain1.com" sends an email to a Google group at "[email protected]", the email is forwarded to group members. While the email gets DKIM authenticated for "domain1.com", the sender shows as "domain2.com", causing a DMARC failure even though DKIM passes. I've been advised to add "domain1.com" to the DKIM settings in Google Workspace, but I'm not sure if that will fix this since Google is just forwarding the emails. I was also told by Google Workspace support that my DMARC policy is set to p=none, which leads to the current alignment issue, and they recommend changing it to p=quarantine or p=reject for proper header rewriting. Does anyone have experience with this?
1 Answer
What you need to check is your DMARC policy for domain1.com. When it's set to p=none, Google doesn't rewrite the From header for emails sent to the group. This could be why you're seeing the DMARC fail. Google stated that they only rewrite the header with stricter policies like p=quarantine or p=reject. You might want to change your DMARC policy to see if that resolves the alignment issue. Just keep in mind that it may look confusing while monitoring your setup with p=none.
Thanks for the clarification! I'm currently set to p=none, but I'm considering opening a support ticket with Google to see if they align with your thoughts. My supervisor is hesitant to change the policy just for testing, but it sounds like it's worth exploring.