title: SPF failure I don't understand with mailchimp
body: <p><strong>In a nutshell</strong></p>
  
  <p>I've configured a SPF policy on my domain but I receive a dmarc report with an failure. I don't understand why there is this failure.</p>
  
  <p><strong>More context</strong></p>
  
  <p>I've configured the following spf policy for my domain <code>zerowasteparis.fr</code>: <code>v=spf1 include:spf.infomaniak.ch include:servers.mcsv.net include:_spf.google.com ~all</code>. I see that <code>servers.mcsv.net</code> resolves to <code>v=spf1 ip4:205.201.128.0/20 ip4:198.2.128.0/18 ip4:148.105.8.0/21 ?all</code>
  (I also configured a dkim policy which seems to work just fine).</p>
  
  <p>I don't understand why I received a dmarc report which contains in particular:</p>
  
  <pre><code>  &lt;record&gt;
      &lt;row&gt;
        &lt;source_ip&gt;198.2.190.251&lt;/source_ip&gt;
        &lt;count&gt;1&lt;/count&gt;
        &lt;policy_evaluated&gt;
          &lt;disposition&gt;none&lt;/disposition&gt;
          &lt;dkim&gt;pass&lt;/dkim&gt;
          &lt;spf&gt;fail&lt;/spf&gt;
        &lt;/policy_evaluated&gt;
      &lt;/row&gt;
      &lt;identifiers&gt;
        &lt;header_from&gt;zerowasteparis.fr&lt;/header_from&gt;
      &lt;/identifiers&gt;
      &lt;auth_results&gt;
        &lt;dkim&gt;
          &lt;domain&gt;automations.mcsv.net&lt;/domain&gt;
          &lt;result&gt;pass&lt;/result&gt;
          &lt;selector&gt;k1&lt;/selector&gt;
        &lt;/dkim&gt;
        &lt;dkim&gt;
          &lt;domain&gt;zerowasteparis.fr&lt;/domain&gt;
          &lt;result&gt;pass&lt;/result&gt;
          &lt;selector&gt;k1&lt;/selector&gt;
        &lt;/dkim&gt;
        &lt;spf&gt;
          &lt;domain&gt;mail251.suw12.mcsv.net&lt;/domain&gt;
          &lt;result&gt;pass&lt;/result&gt;
        &lt;/spf&gt;
      &lt;/auth_results&gt;
    &lt;/record&gt;
  </code></pre>
  
  <p>I don't understand why it contains the line <code>&lt;spf&gt;fail&lt;/spf&gt;</code>.</p>
  
  <p><strong>Why I'm puzzled</strong></p>
  
  <ul>
  <li>From a tech engineering point of view, if I'm not mistaken
  <code>198.2.190.251</code> is in the range <code>ip4:198.2.128.0/18</code> (since it
  represents the range <code>198.2.128.0</code> to <code>198.2.191.255</code>)</li>
  <li>From a social engineering point of view it would mean that <a href="https://mailchimp.com/help/set-up-custom-domain-authentication-dkim-and-spf/" rel="nofollow noreferrer">mailchimp spf doc</a> is incorrect, but since their job is to send email, I'm having
  trouble believing it.</li>
  </ul>
  
  <p>Long story short: I don't understand why I see this failure in this report</p>