Re: [dmarc-ietf] DMARC2 & SPF Dependency Removal

[Tero Kivinen <[e-mail]>]

Tero Kivinen writes:
> > What are those 0.75%, some 30k SPF - DKIM messages? Are there
> > cases of DKIM random failure salvaged by SPF?
> 
> My current analysis script does not try to calculate that, I would
> need to need to add that step there and rerun the script. If I
> understand correctly you would like to see cases where if there is
> both SPF and DKIM, the cases where the both, only one, or neither
> passed, and how many of those cases would be where dkim=fail, but
> spf=pass?

I rerun the statistics and yes, there is 0.84% cases where dkim
failed, but spf returned eithe pass, softfail or neutral.

There was also 1.12% cases where spf returned permerror but dkim
returned pass, and 1.26% cases where dkim returned pass and spf
returned fail, or softfail.

There is of course much bigger part of emails where there was no dkim,
but there was spf that passed (7.03%) or softfailed (1.08%).

Here are the actual numbers for DKIM and SPF result combinations:

	DKIM & SPF combinations
	===========================================
	78.62%  3133749 dkim=pass,spf=pass
	7.03%   280239  dkim=none,spf=pass
	4.68%   186634  dkim=pass,spf=none
	3.85%   153543  dkim=none,spf=none
	1.12%   44543   dkim=pass,spf=permerror
	1.08%   43212   dkim=none,spf=softfail
	0.82%   32821   dkim=fail,spf=pass
	0.78%   30953   dkim=pass,spf=softfail
	0.61%   24221   dkim=none,spf=fail
	0.48%   19329   dkim=pass,spf=fail
	0.43%   17120   dkim=none,spf=neutral
	0.24%   9612    dkim=fail,spf=none
	0.06%   2320    dkim=none,spf=permerror
	0.06%   2214    dkim=pass,spf=neutral
	0.04%   1712    dkim=none,spf=temperror
	0.02%   995     dkim=fail,spf=fail
	0.02%   924     dkim=fail,spf=softfail
	0.02%   669     dkim=temperror,spf=pass
	0.01%   360     dkim=missing,spf=missing
	0.00%   199     dkim=temperror,spf=temperror
	0.00%   196     dkim=fail,spf=neutral
	0.00%   144     dkim=missing,spf=none
	0.00%   119     dkim=pass,spf=temperror
	0.00%   99      dkim=missing,spf=pass
	0.00%   50      dkim=fail,spf=permerror
	0.00%   38      dkim=missing,spf=softfail
	0.00%   14      dkim=temperror,spf=none
	0.00%   10      dkim=temperror,spf=softfail
	0.00%   7       dkim=missing,spf=fail
	0.00%   6       dkim=fail,spf=temperror
	0.00%   6       dkim=missing,spf=neutral
	0.00%   1       dkim=temperror,spf=fail
	0.00%   1       dkim=missing,spf=temperror

I.e. 78.64% of time both DKIM and SPF passed.

I also calculated statistics for all DKIM, SPF, DMARC, and ARC
combinations, but there were so many of them that I do not include the
full list here but here is top 30 from that list:

	Protocol combinations
	============================================================
	37.74%  1504477 dkim=pass,spf=pass,dmarc=missing,arc=missing
	25.37%  1011277 dkim=pass,spf=pass,dmarc=pass,arc=missing
	10.96%  436838  dkim=pass,spf=pass,dmarc=none,arc=missing
	3.46%   138083  dkim=none,spf=pass,dmarc=missing,arc=missing
	2.15%   85799   dkim=pass,spf=none,dmarc=missing,arc=missing
	2.00%   79739   dkim=pass,spf=none,dmarc=pass,arc=missing
	1.96%   78279   dkim=none,spf=none,dmarc=missing,arc=missing
	1.64%   65205   dkim=none,spf=pass,dmarc=none,arc=missing
	1.60%   63758   dkim=pass,spf=pass,dmarc=missing,arc=pass
	1.54%   61579   dkim=none,spf=pass,dmarc=pass,arc=missing
	1.16%   46309   dkim=pass,spf=pass,dmarc=pass,arc=pass
	1.09%   43529   dkim=none,spf=none,dmarc=fail,arc=missing
	0.92%   36478   dkim=pass,spf=pass,dmarc=fail,arc=missing
	0.79%   31298   dkim=none,spf=none,dmarc=none,arc=missing
	0.56%   22504   dkim=none,spf=softfail,dmarc=missing,arc=missing
	0.56%   22123   dkim=pass,spf=permerror,dmarc=missing,arc=missing
	0.55%   21973   dkim=pass,spf=pass,dmarc=none,arc=pass
	0.40%   15760   dkim=fail,spf=pass,dmarc=missing,arc=missing
	0.37%   14855   dkim=none,spf=softfail,dmarc=fail,arc=missing
	0.37%   14716   dkim=pass,spf=softfail,dmarc=missing,arc=missing
	0.34%   13576   dkim=none,spf=fail,dmarc=missing,arc=missing
	0.32%   12745   dkim=pass,spf=permerror,dmarc=none,arc=missing
	0.31%   12348   dkim=pass,spf=softfail,dmarc=pass,arc=missing
	0.26%   10290   dkim=none,spf=neutral,dmarc=missing,arc=missing
	0.24%   9657    dkim=pass,spf=permerror,dmarc=pass,arc=missing
	0.23%   9367    dkim=pass,spf=fail,dmarc=missing,arc=missing
	0.20%   8121    dkim=pass,spf=fail,dmarc=pass,arc=missing
	0.20%   7785    dkim=fail,spf=pass,dmarc=none,arc=missing
	0.17%   6719    dkim=pass,spf=none,dmarc=missing,arc=pass
	0.16%   6248    dkim=none,spf=pass,dmarc=fail,arc=missing

So 37% emails had dkim and spf pass, but no dmarc. 25.37% had also
dmarc.
-- 
[e-mail]