It is interesting that not one person has responded to this. https://forums.zimbra.org/viewtopic.php?f=23&t=51403 Did the poster ever find the cause of this because I see the same. I wish people would take the time to come back and close their questions. Anyhow, I have my desktop client set to c...

Thanks again. Very appreciated.

I think I have it right.

The mail server domain has its own dmarc, dkim and spf records in it's DNS.
All of the domains hosted on it also have their own dmarc, dkim and spf records in their DNS.

Last but not least, if it helps anyone else. Using mxtoolbox, the dmarc record for domains with p=none receive DMARC Policy Not Enabled DMARC Quarantine/Reject policy not enabled I'm not 100% sure if this is a bad thing but it's probably ok while testing and until it's changed to something higher.

I think I have it now, it's a separate TXT entry.

v=DMARC1; p=quarantine; rua=mailto:xxxx@report.com; fo=1

I understand. What I am not finding however is how you introduce the policy setting into the code generated by zimbra.

Thank you very much Bill. I actually have it set to reject because I was seeing some negative results when testing DMARC due to using none. My understanding was that when set to none, while there is a valid DMARC, it seems to get a negative since we're still allowing everything. Looking at the recor...

That might explain why some email keeps landing in spam bins from the domains that are hosted on that server. Do I use the same method as the main domain, meaning... /opt/zimbra/libexec/zmdkimkeyutil -a -d domain1.com /opt/zimbra/libexec/zmdkimkeyutil -a -d domain2.com /opt/zimbra/libexec/zmdkimkeyu...

We have a zimbra 8.8 server that handles around 10 domains. The zimbra server domain is the mx for all of those domains so when a lookup is done for email, it finds the zimbra server domain's mx. When I test DMARC for the zimbra domain, everything looks good because I created the DMARC key for the m...

Thank you for the additional information.

I'm glad that you are able to confirm the problem was not with my mail server.
I do not know of any other way right now. I searched the net all day trying to find a way to allow this domain.
Nothing I tried worked however, only allowing relay did.