Unknown Source: DKIM pass but SPF fail?

Technical Help
1

I’m trying to understand how Zoho could be showing up as a source, and it passes DKIM but fails SPF. We don’t use Zoho at all (it’s not in our SPF record), so I’m just trying to wrap my head around why it’s showing up as a source.

Thanks

2

Hi Chris,
Thanks for joining our forum!
I spoke with one of our technical team members and confirmed Zoho shows up as a source because of forwarded messages.
Thank you,
sean

3

Someone from our domain forwarded a message to an address at Zoho? Or we sent a message to someone, which was then passed along to an address hosted at Zoho?

Is there a way to hide these types of messages from our sources list?

4

Hi Chris,
Great question! The most likely of scenarios is that you sent the original message to a zoho user (they have a hosted email service) who then forwarded it along to another address. In this case, the message was both forwarded and DMARC Capable, which is why it shows up where it does on our app. As for hiding these noisy events, we’ve fielded similar requests before and hope to have something in the works in the next few releases. I’m without a firm timeline on when you can expect it though.

Thank You,
Sean