Why Is DMARC Failing? Causes and How to Fix It

What DMARC Failure Means

DMARC failure means an email did not pass authentication checks as defined by your domain's DMARC policy (RFC 7489). The most common cause is alignment failure — SPF or DKIM passes, but the authenticated domain does not match the From: header domain. The fix depends on which layer is failing: the authentication itself, the alignment, or both.

Depending on your policy setting, a DMARC failure results in:

• Delivered normally (p=none) — The email arrives, but you have lost the protection DMARC provides
• Quarantined (p=quarantine) — The email goes to the recipient's spam/junk folder
• Rejected (p=reject) — The email is blocked entirely, returning a bounce like Gmail's 5.7.26 error

DMARC failure is particularly confusing because SPF and DKIM can individually pass while DMARC still fails. This happens because DMARC adds an extra requirement: alignment.

How DMARC Authentication Works

DMARC does not perform its own authentication. It relies on SPF and DKIM, then checks whether the results align with the domain in the email's From: header.

For DMARC to pass, at least one of these must be true:

1. SPF passes AND the Return-Path domain aligns with the From: domain
2. DKIM passes AND the d= domain in the DKIM signature aligns with the From: domain

"Alignment" means the domains match (or share a common parent domain, if relaxed alignment is configured). This is the concept most administrators miss. For a detailed walkthrough, see DMARC Alignment Failure.

Common Causes of DMARC Failure

1. SPF/DKIM Alignment Failure

This is the most common cause. Your SPF record is valid. Your DKIM signature verifies correctly. But the authenticated domains do not match the From: header domain, so DMARC fails.

Example: Your email From: header shows user@yourcompany.com, but the email is sent through a third-party service whose SPF authenticates as bounce.thirdparty.com and whose DKIM signature uses d=thirdparty.com. Both SPF and DKIM pass for the third-party domain, but neither aligns with yourcompany.com.

Fix: Configure your third-party service to use DKIM signing with d=yourcompany.com (most services support this via DNS CNAME records). Alternatively, configure the service to use a Return-Path under your domain.

See DMARC Alignment Failure: Why SPF/DKIM Pass But DMARC Fails for a detailed walkthrough.

2. No SPF Record or SPF Failure

If there is no SPF record for the sending domain, or if the SPF check fails (the sending IP is not authorized), and DKIM also fails or does not align, DMARC fails.

Check it: Use the mxio SPF Checker on your domain.

Common SPF issues that cause DMARC failure:

• No SPF record published
• SPF record exceeds 10 lookups (PermError = automatic fail)
• Missing include: for a legitimate sending service
• Multiple SPF records on the domain

3. No DKIM Record or DKIM Failure

If DKIM is not configured, or the signature verification fails, and SPF also does not pass with alignment, DMARC fails.

Check it: Use the mxio DKIM Checker with your domain and selector.

Common DKIM issues:

• DKIM not configured on the mail server
• Public key not published in DNS (or wrong selector) — see DKIM Record Not Found
• Body hash verification failure — message modified after signing
• Key rotation without updating DNS

4. Email Forwarding

Email forwarding is one of the most persistent causes of DMARC failure. When a message is forwarded:

• SPF breaks because the forwarding server's IP is not in the original sender's SPF record
• DKIM breaks if the forwarding server modifies the message body (adding footers, modifying headers, rewriting URLs)

This affects mailing lists, university alumni forwarding, and any user@olddomain.com to user@newdomain.com forwarding.

Mitigation: ARC (Authenticated Received Chain, RFC 8617) preserves authentication across forwarding. Major providers (Gmail, Microsoft) support ARC validation. On your end, ensure DKIM is always configured — it survives forwarding better than SPF when the message body is not modified.

5. Third-Party Sending Services

Every service that sends email on your behalf needs proper DMARC alignment configuration:

• Marketing platforms (Mailchimp, HubSpot, Constant Contact)
• Transactional email (SendGrid, Amazon SES, Postmark)
• CRM systems (Salesforce, HubSpot)
• Support desks (Zendesk, Freshdesk, Intercom)
• Email security / filtering (MailRoute, Mimecast, Proofpoint, Barracuda) — these services relay outbound mail on your behalf and need DKIM/SPF configured for your domain
• HR/payroll systems that send notifications

Each service needs at minimum one of:

• DKIM signing with your domain (preferred — survives forwarding)
• SPF with an aligned Return-Path domain

6. Subdomain Misalignment

If you send email from notifications@mail.yourcompany.com but your DMARC record only covers yourcompany.com, the subdomain may not have its own SPF/DKIM configured correctly.

Check: Does mail.yourcompany.com have its own SPF record? Is DKIM configured with d=mail.yourcompany.com or d=yourcompany.com?

By default, DMARC uses "relaxed" alignment, meaning mail.yourcompany.com aligns with yourcompany.com. But if your DMARC record specifies aspf=s or adkim=s (strict alignment), the domains must match exactly.

How to Diagnose DMARC Failures

Step 1: Check Your DMARC Record

Use the mxio DMARC Checker on your domain. Verify that:

• A DMARC record exists at _dmarc.yourdomain.com
• The policy (p=) is set to your intended level
• Reporting addresses (rua=, ruf=) are configured so you receive reports

Step 2: Analyze DMARC Reports

If you have rua= configured, you receive aggregate reports from major receivers. These reports show:

• Which IPs are sending email for your domain
• Whether SPF and DKIM passed or failed for each source
• Whether alignment passed or failed

Step 3: Analyze Individual Message Headers

For specific failures, get the email headers and paste them into the mxio Header Analyzer. Look at the Authentication-Results header:

dmarc=fail (p=none dis=none) header.from=yourdomain.com

This tells you DMARC failed, what policy was applied, and which domain was evaluated.

Step 4: Identify All Sending Sources

Create a complete inventory of every service, server, and application that sends email using your domain. For each one, verify SPF includes and DKIM configuration. The Email Authentication Guide covers how SPF, DKIM, and DMARC work together across multiple sending sources.

Fixing DMARC: Step by Step

Step 1: Start with p=none

If you are just setting up DMARC, start with p=none to enable monitoring without affecting delivery. See No DMARC Record Found for the initial setup guide.

Step 2: Configure DKIM for Every Sending Service

DKIM alignment is more reliable than SPF alignment for third-party services because DKIM survives forwarding. Configure custom DKIM signing for every service that sends as your domain.

Step 3: Update Your SPF Record

Add include: mechanisms for all legitimate sending IPs. If your record is approaching the 10-lookup limit, consider SPF flattening or mxio's Managed SPF to keep the record under the limit automatically.

Step 4: Monitor Reports

Monitor aggregate reports for 2-4 weeks to identify any remaining unauthorized or misconfigured sources.

Step 5: Move to p=quarantine

Once legitimate sources consistently pass, move to p=quarantine. Use the pct= tag to enforce gradually. See DMARC p=none: Why You Should Enforce for the progression path.

Step 6: Move to p=reject

Once you are confident all legitimate email passes DMARC, move to p=reject for full protection.

Prevention and Ongoing Monitoring

DMARC failures are not a one-time fix. New sending services get added, DKIM keys expire, SPF records accumulate includes, and email forwarding introduces failures at any time.

Set up domain health monitoring to catch DMARC authentication failures, SPF record changes, and DKIM key issues the moment they happen. mxio monitors your email authentication continuously — you know the moment something breaks, before it affects deliverability.

Related Issues

• DMARC Alignment Failure — Deep dive into why SPF/DKIM pass but DMARC fails
• No DMARC Record Found — Setting up DMARC from scratch
• DMARC p=none: Why You Should Enforce — Moving beyond monitoring
• Gmail Error 550 5.7.26 — Gmail rejecting email due to DMARC
• Emails Going to Spam — DMARC failure is a top spam cause