spoofed email is delivered when dmarc fails

[Sascha0579]

hi folks,

if i use telnet from external to our cisco esa with:
--- snip ---
ehlo foobar.org
MAIL FROM: <noreply@company.org>
RCPT TO: <user@company.org>
DATA
To: <user@company.org>
Subject: Testing new script"
This is only another test with the script."

.

quit
--- snap ---

in the logs i see that SPF and dkim failed .. and the DMARC check fails too
"DMARC Verification skipped (Sending domain could not be determined)."
so this email is delivered.

How i can prevent this? or is this a misconfiguration? or bug?

[Dustin Anderson]

With no domain being valid, there would be no SPF or DKIM to check so it would pass the email. you could verify by spoofing say gmail.com or another site with DNS settings.

you could also set up domain verification but in your example it would be unknown and not sure you want to reject any unknown domain.