Strict SPF is passed by some other domain???

[Richard G]

Oke today I received 2 reports from Yahoo, this is one of them.
The mydomain.nl is my domain.

  <policy_published>  
    <domain>mydomain.nl</domain>  
    <adkim>r</adkim>  
    <aspf>s</aspf>  
    <p>quarantine</p>  
    <pct>100</pct>  
  </policy_published>  
  <record>  
    <row>  
      <source_ip>209.85.214.228</source_ip>  
      <count>1</count>  
      <policy_evaluated>  
        <disposition>quarantine</disposition>  
        <dkim>fail</dkim>  
        <spf>fail</spf>  
      </policy_evaluated>  
    </row>  
    <identifiers>  
      <header_from>mydomain.nl</header_from>  
    </identifiers>  
    <auth_results>  
      <spf>  
        <domain>mcdialogue.net</domain>  
        <result>pass</result>  
      </spf>  
    </auth_results>  
  </record>  
  <record>  
    <row>  
      <source_ip>209.85.222.226</source_ip>  
      <count>1</count>  
      <policy_evaluated>  
        <disposition>quarantine</disposition>  
        <dkim>fail</dkim>  
        <spf>fail</spf>  
      </policy_evaluated>  
    </row>  
    <identifiers>  
      <header_from>mydomain.nl</header_from>  
    </identifiers>  
    <auth_results>  
      <spf>  
        <domain>alhayattv.net</domain>  
        <result>pass</result>  
      </spf>  
    </auth_results>  
  </record>  
</feedback>

As you can see, the policy of my domain is to quarantaine 100%.
But when you look at SPF, it says the mcdialogue.net is a pass, this can not be true.

This is my domain setup:

"v=spf1 a mx ip4:138.xxx.xxx.xxx ip6:2a01:4f8:xxxx:xxxx::xx -all"

so this is a strict SPF record.
Ofcourse DKIM is also present as is DMARC:

v=DMARC1;p=quarantine;sp=reject;rua=mailto:91xxx etc.

Next to that, my domain also has domain keys.

Now how can it be that in the end that alhayattv .net is passing SPF?
The 209.85.214.228 is a Google ip, but my company did not send any e-mail to any of the companies mentioned here.

Now I also put it through the DMARC analyzer and DMARC and DKIM fail, but why is SPF passing while I got a strict SPF record due to the -all setting?



Am I missing something? This should not happen with a -all right?
Or is the Yahoo SPF check failing here?