EML — dkim=pass but dmarc=fail on Strict Alignment
SPF passes and DKIM passes, yet DMARC fails — because the signing domain is the relay's, not the From domain's, and the policy demands strict alignment. Any dashboard that reports authentication by reading dkim= alone shows this message as trustworthy.
Return-Path: <notify@mailer.example>
Received-SPF: pass (mailer.example: 203.0.113.99 is authorized) client-ip=203.0.113.99;
Authentication-Results: mx1.meridiansupply.example;
spf=pass smtp.mailfrom=mailer.example;
dkim=pass header.d=mailer.example header.s=relay2026;
dmarc=fail (p=QUARANTINE sp=QUARANTINE adkim=s aspf=s) header.from=brightside.example
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=mailer.example; s=relay2026; t=1771200000;
h=from:to:subject:date:message-id;
bh=SAMPLEbodyHashBase64Placeholder0000000000000=;
b=SAMPLEsignatureBase64Placeholder00000000000000000000000000000000/NOTREAL=
From: Maya Chen <maya@brightside.example>
To: Sam Rivera <sam@meridiansupply.example>
Subject: Newsletter relayed by a third party
Date: Tue, 17 Feb 2026 08:10:00 -0800
Message-ID: <p7-auth-align@brightside.example>
MIME-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: 7bit
The authentication headers are the fixture; the body is filler.
Every DKIM and ARC value in this message is a visible SAMPLE placeholder
and will not verify against any key.
Specifications
- Wave
- p7
- Seed
- 20260807
- Spf
- pass
- Dkim
- pass
- Dmarc
- fail
- Adkim
- s
- Aspf
- s
- Signing Domain
- mailer.example
- From Domain
- brightside.example
- Aligned
- false
- Line Endings
- CRLF (RFC 5322)
Testing contract
Expected to pass- Scenario
- Evaluate a message where both SPF and DKIM report pass but the DMARC result is fail due to strict domain alignment.
- Expected result
- The overall verdict follows dmarc=fail; header.d=mailer.example is reported as unaligned with header.from=brightside.example.
What is a .eml file?
An EML file is a single email message stored in the RFC 822 / MIME format — plain-text headers (From, To, Subject, Date, Message-ID) followed by the body, which may be plain text, HTML, or a multipart structure with alternative bodies and file attachments encoded in base64.
How to use this file
Use an example EML to test email header parsing, MIME decoding, HTML-part handling, attachment extraction, and EML-to-other-format conversion.
How to use this file for testing
“EML — dkim=pass but dmarc=fail on Strict Alignment” is a deterministic Novus Examples fixture for Email parsing, Metadata testing. Standards-compliant RFC 822 messages — plain, multipart text+HTML, and with an attachment — plus an MBOX mailbox, for testing header parsing, MIME decoding, attachment extraction, and mailbox splitting.
Documented properties for this file: seed 20260807 · CRLF (RFC 5322). Compare results against paired or grouped companions on this page when present (clean↔damaged, searchable↔scanned, or format twins) so scores stay reproducible across runs.
Download the file once, keep the path stable in CI or local scripts, and treat the spec table as the contract: dimensions, seeds, field lists, and roles are intentional. Corrupt or invalid samples are labelled as such — expect parsers to fail loudly rather than silently accept them.
Email fixtures use fixed dates, message IDs, and MIME boundaries so runs are reproducible, and every address is fictional. Test header parsing, MIME decoding, attachment extraction, and EML/MBOX conversion against the documented structure.
Code examples
from email import policy
from email.parser import BytesParser
msg = BytesParser(policy=policy.default).parse(open("p7-auth-alignment-fail.eml", "rb"))
print(msg["subject"], msg["from"])Related files
- emlDKIM / SPF Annotated Email (EML)An email annotated with DKIM-Signature, Received-SPF, and Authentication-Results headers (all reporting pass) — for testing email-authentication header parsing. The DKIM signature value is a sample placeholder, not real cryptography.
- emlBounce / Non-Delivery Report (EML)A bounce / non-delivery report (NDR) — a multipart/report message with a human-readable notice, a message/delivery-status part, and the original headers — for testing bounce parsing and delivery-status extraction.
- emlEmail with Attachment (EML)A multipart/mixed email with a base64-encoded CSV file attachment — for testing attachment detection, decoding, and extraction from an EML message.
- emlEML — 1,024-Octet Header Line With No Fold PointA single header whose value is one 1,001-character token with no whitespace, making the line 1,024 octets — past the 998-octet limit RFC 5322 sets and impossible to fold. Fixed-size line buffers truncate here, and the truncation is silent.
- emlEML — Adjacent Encoded-Words (Separator Must Disappear)A Subject split mid-word across two adjacent encoded-words. RFC 2047 requires the linear whitespace between them to be discarded, so the correct result is one word; a decoder that keeps the space renders a split that reads as a typo.
- emlEML — Attachment With No Filename At AllAn attachment with a bare Content-Disposition: attachment and no name in either header. A client has to invent a filename, and the extension it invents decides whether the saved file opens as a spreadsheet or as unknown binary.
Generated by generation/email_p7.py. Free for any use, no attribution required — license.