You may see some unknown sources in the Reports section of OnDMARC that pass DKIM. 

This usually occurs when you email the source in question and the source then forwards this email on. In this case SPF fails, however DKIM survives forwarding and your DKIM signature is preserved until it reaches the final destination.

In this case the final recipient correctly verifies your DKIM signature and your email passes DMARC. The source is shown as the sender because it forwarded your emails and it is the last hop in the mail flow. 

An example of a source that is a forwarder is typically identified by having 0% SPF  and 100% DKIM pass rate. 

The above is an example of why email senders should configure both SPF and DKIM in case their emails are being forwarded. If only SPF was configured then the emails would have failed.

Did this answer your question?