title: Why SPF fail and DKIM passed in DMARC reports?
body: <p>My domain( e.g. xyz.com) email is hosted on Gsuite. I am trying to set up DMARC for my domain.
  On the first day, I have received aggregate reports from multiple mail servers.
  in these reports, I found my domain using some other service(subscription, product rating).</p>
  <p>These services sending mail to the customers with mail from my domain header with services domain(e.g. mail.service.com). so I have set up the dedicated domain for these services using SendGrid(CNAME).
  Also, I have created DKIM for my Gsuite domain and created the record in the domain panel.</p>
  <p><strong>Now is everything perfect but in the aggregate reports some records are failed to pass SPF validation but DKIM pass. Why DKIM passed or SPF failed?</strong></p>
  <p>Here are sample records</p>
  <pre><code>v=spf1 include:_spf.google.com ~all (main domain)
  v=spf1 include:sendgrid.net ~all (email.xyz.com sendgrid)
  v=spf1 ip4:149.72.201.23 ip4:149.72.27.244 *(multipal ip4 records)* -all (em1234.xyz.com sendgrid)
  </code></pre>
  <p>Below are the aggregate report's two records:</p>
  <pre><code>&lt;record&gt;
      &lt;row&gt;
        &lt;source_ip&gt;104.47.56.175&lt;/source_ip&gt;
        &lt;count&gt;1&lt;/count&gt;
        &lt;policy_evaluated&gt;
          &lt;disposition&gt;none&lt;/disposition&gt;
          &lt;dkim&gt;pass&lt;/dkim&gt;
          &lt;spf&gt;fail&lt;/spf&gt;
        &lt;/policy_evaluated&gt;
      &lt;/row&gt;
      &lt;identifiers&gt;
        &lt;header_from&gt;xyz.com&lt;/header_from&gt;
      &lt;/identifiers&gt;
      &lt;auth_results&gt;
        &lt;dkim&gt;
          &lt;domain&gt;xyz.com&lt;/domain&gt;
          &lt;result&gt;pass&lt;/result&gt;
          &lt;selector&gt;kl&lt;/selector&gt;
        &lt;/dkim&gt;
        &lt;spf&gt;
          &lt;domain&gt;xyz.com&lt;/domain&gt;
          &lt;result&gt;softfail&lt;/result&gt;
        &lt;/spf&gt;
      &lt;/auth_results&gt;
    &lt;/record&gt;
  &lt;record&gt;
  &lt;row&gt;
    &lt;source_ip&gt;209.85.220.41&lt;/source_ip&gt;
    &lt;count&gt;1&lt;/count&gt;
    &lt;policy_evaluated&gt;
      &lt;disposition&gt;none&lt;/disposition&gt;
      &lt;dkim&gt;pass&lt;/dkim&gt;
      &lt;spf&gt;fail&lt;/spf&gt;
    &lt;/policy_evaluated&gt;
  &lt;/row&gt;
  &lt;identifiers&gt;
    &lt;header_from&gt;xyz.com&lt;/header_from&gt;
  &lt;/identifiers&gt;
  &lt;auth_results&gt;
    &lt;dkim&gt;
      &lt;domain&gt;xyz.com&lt;/domain&gt;
      &lt;result&gt;pass&lt;/result&gt;
      &lt;selector&gt;kl&lt;/selector&gt;
    &lt;/dkim&gt;
    &lt;dkim&gt;
      &lt;domain&gt;sendgrid.info&lt;/domain&gt;
      &lt;result&gt;pass&lt;/result&gt;
      &lt;selector&gt;smtpapi&lt;/selector&gt;
    &lt;/dkim&gt;
    &lt;spf&gt;
      &lt;domain&gt;gmail.com&lt;/domain&gt;
      &lt;result&gt;pass&lt;/result&gt;
    &lt;/spf&gt;
  &lt;/auth_results&gt;
  &lt;/record&gt;
  </code></pre>