DMARC Hold with SPF Failure - Apr 2023

Known Issue

Date Logged	April 3rd, 2023
Product(s)	DMARC Analyzer
Status	Not Fixing

Issue

If your definition settings conflict, the most restrictive action wins. If an email qualifies for a DMARC hold but has an SPF Failure, the Spam Scanning Policy takes precedence. The email with headers tagged by Spam Scanning will be delivered, despite failing DMARC from Domains with Quarantine Policy.

This is a known limitation not on the Mimecast Product Team Roadmap to resolve. 

Workaround

• Read about the Action Severity Consideration options in the DNS Authentication Configuration Guide below.

See Also…

• DMARC Analyzer - v2.4.0 Release Notes - Mar 2022
• DNS Authentication Configuration
• Configuring DNS Authentication Policy