Google's Postmaster tools always tell me 100% DKIM, 100% SPF but a crazy varying amount of DMARC success rate. Postmark's weekly report gives me 99.9% DMARC compliance. Do you have an explanation or theory? Our envelope-from often differs from header-From but none of those domains have a strict DMARC alignment policy.
I believe you can explain some common cases in Postmark's weekly digest like this (but would really appreciate confirmation from an actual specialist in the field):
1. "Trusted sources" (DMARC fully/partially aligned), DKIM pass, but SPF fail: a recipient has forwarded your fully-aligned email.
2. "Untrusted sources" (DMARC not aligned), DKIM fail, SPF fail: genuine spam, or email forwarding that also rewrites headers in way that breaks DKIM (like the recent Hotmail/Outlook.com forwarding problem).
3. "Untrusted sources", DKIM pass, SPF pass: properly signed and SPF'd, but your envelope-from domain doesn't match the header-From domain. If your DMARC policy is reject or quarantine, these messages won't get delivered.
One way to get case 3 is with a vendor sending on your behalf, where you've included their SPF in your own record (so SPF pass), but they sign DKIM and set envelope-from using their domain. The DKIM is valid for your vendor, so passes, but doesn't match the From, so DMARC is not aligned and fails.
For example, UserVoice has this problem if you're using a custom From address in your domain. And Gmail shows this type of message as "From <you> via <vendor>".
I can't say without more details, but if you can reach out to me privately, I'm more than happy to dig through logs on our mail servers (well, dig through our Splunk platform...) and tell you exactly what we're seeing from your domain.
