Why does Google reports on DMARC show IPv6?

Question

gmail

I have two servers on digitalocean. On everyone sites and a mailer lie. For some reason, when I send emails to gmail, it always ends up in spam. Everything is configured: dkim, dmarc, spf. IPv6 disabled. The situation is as follows: google has started sending DMARC reports and there is a strange block here, namely:

<?xml version="1.0" encoding="UTF-8" ?>
<feedback>
  <report_metadata>
    <org_name>google.com</org_name>
    <email>[email protected]</email>
    <extra_contact_info>https://support.google.com/a/answer/2466580</extra_contact_info>
    <report_id>8983433048806662136</report_id>
    <date_range>
      <begin>1553644800</begin>
      <end>1553731199</end>
    </date_range>
  </report_metadata>
  <policy_published>
    <domain>domain.com</domain>
    <adkim>r</adkim>
    <aspf>r</aspf>
    <p>reject</p>
    <sp>reject</sp>
    <pct>100</pct>
  </policy_published>
  <record>
    <row>
      <source_ip>46.101.194.*</source_ip>
      <count>3</count>
      <policy_evaluated>
        <disposition>none</disposition>
        <dkim>pass</dkim>
        <spf>pass</spf>
      </policy_evaluated>
    </row>
    <identifiers>
      <header_from>domain.com</header_from>
    </identifiers>
    <auth_results>
      <dkim>
        <domain>domain.com</domain>
        <result>pass</result>
        <selector>mail</selector>
      </dkim>
      <spf>
        <domain>domain.com</domain>
        <result>pass</result>
      </spf>
    </auth_results>
  </record>
  <record>
    <row>
      <source_ip>2a06:6440:0:2c13::2</source_ip>
      <count>1</count>
      <policy_evaluated>
        <disposition>reject</disposition>
        <dkim>fail</dkim>
        <spf>fail</spf>
      </policy_evaluated>
    </row>
    <identifiers>
      <header_from>domain.com</header_from>
    </identifiers>
    <auth_results>
      <spf>
        <domain>h47.default-host.net</domain>
        <result>none</result>
      </spf>
    </auth_results>
  </record>
</feedback>

It is the last block that confuses me, where the IPv6 address is:

<record>
    <row>
      <source_ip>2a06:6440:0:2c13::2</source_ip>
      <count>1</count>
      <policy_evaluated>
        <disposition>reject</disposition>
        <dkim>fail</dkim>
        <spf>fail</spf>
      </policy_evaluated>
    </row>
    <identifiers>
      <header_from>domain.com</header_from>
    </identifiers>
    <auth_results>
      <spf>
        <domain>h47.default-host.net</domain>
        <result>none</result>
      </spf>
    </auth_results>
  </record>

Exim found the following lines in the logs:

2019-03-25 17:31:51 1h8RZk-0005Ha-Ie <= [email protected] H=web-relay-6.default-host.net [185.104.44.49] P=esmtps X=TLSv1 .2:ECDHE-RSA-AES256-GCM-SHA384:256 CV=no S=6239 [email protected]$
2019-03-25 17:31:51 1h8RZk-0005Ha-Ie = > anton R=localuser_spam T=local_spam_delivery
2019-03-25 17:31:51 1h8RZk-0005Ha-Ie Completed

Could this affect the delivery of emails from our server to the GMAIL inbox?

Answer 1

If you sign emails with DKIM and 2a06:6440:0:2c13::2 is not your address (this is not Digital Ocean, but Hosting Ukraine Ltd.), then someone is trying to send fake emails from your domain from this address.
This should not affect the delivery of your emails specifically to GMail.