Why does a message have a high Message Trust Score when SPF, DKIM or DMARC do not pass?

Agari Phishing Defense (APD) uses a number of factors to determine the Message Trust Score. Agari takes into the account of SPF/DKIM/DMARC pass/fails, along with a large number of other data points to determine the overall message trust score. Agari recognizes that not everyone has perfect records, and as such does not solely score messages on SPF/DKIM/DMARC fails. APD protects you from attackers focusing on Identity Deception, which oftentimes is independent of DMARC passes or failures. Many good attackers will either properly configure their domains, or use publicly hosted environments to send their attacks out which can pass all authenticity checks.

Due to the nature of Identity Deception, and the need to be able to account for environments with imperfect DMARC records, solely passing or failing SPF/DKIM/DMARC can have a varying range of effect on message scoring. The "weight" of the pass/fail can vary due to a large range of other factors in our AI's algorithms and should not be considered a decisive factor. 

If you would like to stop all messages failing SPF/DKIM/DMARC authentication Agari recommends you do this upstream at a SEG level.