@Mark Berry, it just occurred to me that perhaps the "pass" result in the "auth_results, dkim" section is simply confirming that a valid DKIM record was found for the "groups.io" domain.

Sorry, I only thought of this after I realized the "policy evaluated" section shows "fail" in the "dkim" section and appears to be (rightly) determining that the DKIM is invalid. I'm trying to find the relevant docs that may explain this.

What I don't understand is why the "source ip" does not show up on any block list yet. :(
--
Jim