DMARC Fail: What It Means and How to Fix It

What Does DMARC Fail Mean?

DMARC checks one thing: is the domain people see in the From address backed by SPF or DKIM? A message passes DMARC when at least one of them passes for a domain that aligns with the From domain. It fails when neither does. (RFC 9989)

That is why a message can pass SPF and pass DKIM and still fail DMARC: SPF checks the bounce address (MAIL FROM, also called Return-Path), and DKIM checks the domain in its signature (d=). Neither is the address the reader sees. If both belong to someone else, DMARC fails.

Aligned has two meanings, chosen by the domain's DMARC record (the DMARC Checker shows which one it uses). Relaxed (the default) needs the same organizational domain, so news.example.com aligns with example.com. Strict needs the exact same name.

Where You See DMARC Fail

The same result shows up under different names, depending on who checked the message:

Gmail's codes come from its list of SMTP errors; Microsoft's from its DMARC guide. Mimecast's DNS Authentication policy has a DMARC - Fail result whose recommended action is Honor DMARC Record: "Should an inbound message fail these checks, an action defined in the sending domain's DMARC DNS record is applied." (Mimecast)

Why DMARC Fails: 6 Common Causes

Almost every DMARC failure is one of these. The first is by far the most common.

SPF has one more trap: a record that needs more than 10 DNS lookups gives permerror, which counts as not passing. Check the count with the SPF Checker. (RFC 7208)

Forwarding is why a domain at p=reject must not rely on SPF alone: the forwarder's server isn't in your SPF record, so only an intact DKIM signature still passes. Mailing lists often rewrite the From address to stay aligned. (RFC 9989)

A message with no DKIM signature at all, or one that fails, usually means the service's DKIM records were never published: look a domain's keys up with the DKIM Checker.

How to Read DMARC Fail in the Headers

Take the receiver's Authentication-Results header and compare three domains. In this example, SPF and DKIM both pass, but for example.net, while the From address is at example.com:

Authentication-Results: spf=pass (sender IP is 192.0.2.10)
  smtp.mailfrom=bounces.example.net;
  dkim=pass (signature was verified) header.d=example.net;
  dmarc=fail action=oreject header.from=example.com

1. Find the From domainheader.from= is the domain DMARC protects (example.com).
2. Check SPF alignmentsmtp.mailfrom= is bounces.example.net: another organizational domain, so SPF doesn't align even though it passed.
3. Check DKIM alignmentheader.d= is example.net: DKIM passed for someone else's domain, so it doesn't align either.
4. Read the policy actionBoth failed, so DMARC failed; action=oreject means the domain asks for reject and the receiver applied it.

Paste a whole header into the Email Header Analyzer to see these results laid out, with the path the message took. Microsoft's guide walks through the same three checks. (Microsoft)

How to Fix DMARC Fail

Fix each sending service in turn. A message only needs one aligned pass, but DKIM is the one that survives forwarding, so aim for DKIM on everything.

1. Check your DMARC recordLook up the policy, the alignment modes and where reports go with the DMARC Checker below.
2. List every service that sends as youYour mailbox provider, newsletter platform, CRM, helpdesk and billing system. Aggregate reports (rua=) name the sending IPs you missed: the DMARC Report Analyzer merges them by sender.
3. Align DKIM at each serviceTurn on its domain authentication or custom DKIM, publish the records it gives you, and check that d= now shows your domain.
4. Align SPF where you canSet a custom MAIL FROM (bounce) domain under your own domain and keep aspf relaxed.
5. Send a real testSend a message from each service to the one-time address of the Email Deliverability Test and confirm dmarc=pass.
6. Then tighten the policyMove from p=none to quarantine, then reject, once reports show every legitimate source passing.

To test real mail, open the Email Deliverability Test, send to the one-time address, and read the SPF, DKIM and DMARC rows of the report. Build or repair the record itself with the DMARC Generator.

Amazon SES, Microsoft 365 and Mimecast

Amazon SES. For SPF alignment, set up a custom MAIL FROM domain and keep a relaxed SPF policy; SES notes that alignment needs your DMARC record not to specify strict SPF (aspf=s). For DKIM alignment, use Easy DKIM so SES signs with your domain. (AWS)

Microsoft 365. Configure DKIM signing with your custom domain, so the signing domain aligns with the From address. Its most common failure is a non-Microsoft service that signs with its own d= or bounces from its own domain. Outbound mail that fails DMARC at the receiver goes through Microsoft's high-risk delivery pool when your policy is quarantine or reject. (Microsoft)

Mimecast. If you send outbound mail through Mimecast and DKIM-sign earlier, for example in Microsoft 365 or an on-premises server, Mimecast warns that "the check will likely fail on the recipient side": only Mimecast should sign. For inbound mail that shows DNS Authentication: DMARC Fail, the fix belongs to the sending domain. (Mimecast)

Should You Switch to p=none?

Only while you find your senders. p=none asks receivers to change nothing: it turns on reporting and leaves delivery to their usual filters. (RFC 9989)

Lowering p=reject to p=none to stop DMARC failures also stops protecting your domain from spoofing. The better order is the other way round: start at p=none with reports, fix each legitimate stream, then move to quarantine and reject. Since 2024 Gmail and Yahoo ask bulk senders for DMARC, and Gmail accepts p=none for that. (Gmail)