I have asked a question on postfix’s mailing list that, if a message from mail.ru (who has p=reject setting in their DMARC) was forwarded by Pobox to gmail, will gmail reject this message?
The list member @raf gave a wonderful answer below. I much appreciate it.
Maybe. It depends on lots of stuff. A DMARC check passes if either SPF or DKIM pass, but (for DMARC purposes), SPF only applies (and therefore can only pass) when the From: domain matches the envelope sender domain, and (for DMARC purposes) DKIM only applies (and therefore can only pass) when the From: domain matches the DKIM signing domain (d=). If pobox.com uses its own envelope sender when forwarding the email, then mail.ru's SPF doesn't apply (because it wouldn't be the envelope sender domain anymore). Instead, pobox.com's SPF applies (because it's now the envelope sender domain). But pobox.com's SPF doesn't apply to mail.ru's DMARC check. So SPF wouldn't contribute to a DMARC check for mail.ru. If pobox.com uses the original mail.ru envelope sender then mail.ru's SPF will apply and it will fail (because pobox.com won't be authorized by mail.ru's SPF). So it won't contribute to a DMARC check for mail.ru either. So, you can't count on SPF to get it through a DMARC check for mail.ru. The only other possibility is if the email was DKIM-signed by mail.ru as well. If it wasn't, then DMARC fails. If it was, and the email wasn't changed en route in any way that invalidated the DKIM signature, then DMARC passes. If the mail was modified too much, then DMARC fails, but if pobox.com is just forwarding, then it shouldn't have modified it in a way that matters to DKIM. And the DKIM signature has to have been signed with mail.ru's DKIM key. Any other signing domain doesn't apply for DMARC purposes. So, if it's DKIM-signed by mail.ru, and pobox.com just forwards it, and does nothing else other than adding headers along the way, then it'll probably pass a DMARC check for mail.ru. Otherwise, it won't. Having said all that, what gmail does with it upon arrival is entirely up to gmail.
