我如何从dmarc汇总报告中识别转发的记录？

Question

我有一个DMARC聚合报告，其中分析软件告诉我具有196.1.105.47 IP的记录已转发邮件。

根据什么参数确定它是转发邮件？

报告为：

<?xml version="1.0"?>   
<feedback>  
<report_metadata>   
    <org_name>Yahoo! Inc.</org_name>    
    <email>postmaster@dmarc.yahoo.com</email>   
    <report_id>1556067595.225822</report_id>    
    <date_range>    
    <begin>1555977600</begin>   
    <end>1556063999 </end>  
    </date_range>   
</report_metadata>  
<policy_published>  
    <domain>kratikal.com</domain>   
    <adkim>r</adkim>    
    <aspf>r</aspf>  
    <p>none</p> 
    <pct>100</pct>  
</policy_published> 
<record>    
    <row>   
    <source_ip>168.245.20.240</source_ip>   
    <count>11</count>   
    <policy_evaluated>  
        <disposition>none</disposition> 
        <dkim>pass</dkim>   
        <spf>pass</spf> 
    </policy_evaluated> 
    </row>  
    <identifiers>   
    <header_from>kratikal.com</header_from> 
    </identifiers>  
    <auth_results>  
    <dkim>  
        <domain>sendgrid.info</domain>  
        <result>pass</result>   
    </dkim> 
    <spf>   
        <domain>em2121.kratikal.com</domain>    
        <result>pass</result>   
    </spf>  
    </auth_results> 
</record>   
<record>    
    <row>   
    <source_ip>196.1.105.47</source_ip> 
    <count>1</count>    
    <policy_evaluated>  
        <disposition>none</disposition> 
        <dkim>pass</dkim>   
        <spf>fail</spf> 
    </policy_evaluated> 
    </row>  
    <identifiers>   
    <header_from>kratikal.com</header_from> 
    </identifiers>  
    <auth_results>  
    <dkim>  
        <domain>kratikal.com</domain>   
        <result>pass</result>   
    </dkim> 
    <spf>   
        <domain>u7623503.wl004.sendgrid.net</domain>    
        <result>fail</result>   
    </spf>  
    </auth_results> 
</record>   
</feedback>

Dmarc是： v=DMARC1; p=none; rua=mailto:dmarc@kratikal.com; ruf=mailto:dmarc@kratikal.com; fo=1;