DMARC Fail: Why DMARC Fails and How to Fix It

DMARC fails when a message has no SPF or DKIM pass for a domain that matches (aligns with) the domain in the visible From address. Most of the time SPF and DKIM themselves are passing, but for your email provider's domain instead of yours, so DMARC sees no aligned result. The fix is almost always to set up custom DKIM signing for that sending service so it signs with your domain.

If your domain publishes p=quarantine or p=reject, a DMARC failure means mail goes to spam or bounces. At Gmail, a rejected message looks like this:

550-5.7.26 Unauthenticated email from example.com is not accepted due to domain's
550-5.7.26 DMARC policy. Please contact the administrator of example.com domain
550-5.7.26 if this was a legitimate mail. Please visit
550-5.7.26 https://support.google.com/mail/answer/2451690 to learn about the
550 5.7.26 DMARC initiative. - gsmtp

If you need a refresher on the moving parts, start with What is DMARC?. If you're seeing Gmail's 5.7.26 specifically, also see 550 5.7.26: unauthenticated email is not accepted.

What "DMARC fail" actually means

A message passes DMARC if either of these is true:

• SPF passes, and the Return-Path (envelope sender) domain aligns with the From domain.
• DKIM passes, and the signing domain (d=) aligns with the From domain.

Under the default relaxed alignment, "aligns" means the two share an organizational domain, so bounce.example.com aligns with example.com. Under strict alignment (aspf=s or adkim=s), they must match exactly.

So DMARC can fail even when both SPF and DKIM say pass. That's the part that confuses people, and it's the most common case.

Find out which part is failing

Don't guess. Get the headers of a failing message (send one to a Gmail or Outlook.com mailbox you control, then view the original) and find the Authentication-Results header. It looks something like this:

Authentication-Results: mx.google.com;
       dkim=pass header.i=@esp-example.net header.s=s1;
       spf=pass smtp.mailfrom=bounce-123@mail.esp-example.net;
       dmarc=fail (p=REJECT sp=REJECT dis=REJECT) header.from=example.com

Read it left to right: DKIM passed for esp-example.net, SPF passed for mail.esp-example.net, the From domain is example.com, and neither passing domain aligns with it. Paste the full headers into the email header analyzer if you'd rather not squint, or read how to read an email header.

Your DMARC aggregate reports tell you the same thing at scale: which IPs sent as your domain, and whether SPF, DKIM and alignment passed for each.

Common causes, most likely first

1. A sending service isn't signing DKIM with your domain

This is the big one. Your ESP, CRM, helpdesk or billing platform sends as you@example.com but signs DKIM with its own domain, and uses its own Return-Path. Everything "passes," nothing aligns. It happens most with tools someone in another department set up without telling IT.

2. The service isn't authenticated at all

The tool sends from its own IPs, isn't in your SPF record, and doesn't sign DKIM. Both checks fail outright. Common with scanners, printers, website contact forms and small SaaS tools.

3. Your SPF record is broken

If your SPF record has more than 10 DNS lookups, or you've published two SPF records, SPF returns permerror and never passes. Any mail relying on SPF for DMARC fails. See the SPF 10 DNS lookup limit, or run your record through the SPF lookup counter.

4. Forwarding broke SPF

When a message is forwarded (an alumni address, a rule that forwards to Gmail), the forwarding server's IP isn't in your SPF record, so SPF fails at the final destination. DKIM usually survives forwarding, which is why aligned DKIM matters more than aligned SPF. If you only have aligned SPF, forwarded mail will fail DMARC.

5. A mailing list modified the message

Mailing lists often add a subject tag or footer. That changes the signed content and breaks the DKIM signature, and the list's server sends from its own IP, so SPF doesn't align either. Many list servers now rewrite the From address to avoid this. It's a known DMARC limitation, not something you can fully fix from your side. ARC (Authenticated Received Chain) exists to help receivers trust intermediaries that modify mail, but it depends on the intermediary and receiver supporting it.

6. Strict alignment where you need relaxed

If your record has adkim=s or aspf=s, a signature for mail.example.com won't align with a From of example.com. Unless you have a specific reason for strict mode, use the relaxed default.

7. DKIM key problems

The selector in DNS was deleted, the key was rotated on one side but not the other, or the TXT record got truncated when pasted into a DNS console. DKIM fails outright, and if SPF isn't aligned either, DMARC fails.

8. Someone is spoofing you

Sometimes the failures in your reports aren't yours. Unrecognized IPs in countries you don't send from, failing everything, are usually spoofing. That's DMARC working: those are the messages your policy is meant to stop.

How to fix DMARC failures, step by step

1. Identify the source. Use the Authentication-Results header or your aggregate reports to find the sending IP and the domains SPF and DKIM passed for. Map each IP to a service.
2. Set up custom DKIM for each legitimate service. In the service's settings, look for "domain authentication," "custom DKIM" or "sender authentication." It will give you one or more CNAME or TXT records to publish. Once live, the service signs with d=example.com (or a subdomain), and DMARC passes on DKIM.
3. Set up a custom Return-Path where offered. Many services let you use a subdomain like bounce.example.com as the envelope sender. That gives you aligned SPF as a backup.
4. Fix SPF. Remove services you no longer use, get under 10 lookups, and make sure there's exactly one SPF record. You don't need to add a service to your root SPF record if it uses its own Return-Path domain; SPF checks the Return-Path, not the From.
5. Fix anything that can't authenticate. If a printer or a legacy app can't sign DKIM, route it through a mail server or relay that can, or move it to a subdomain with its own policy.
6. Leave the spoofers alone. Don't add unrecognized IPs to SPF to make the failures go away.

How to confirm it's fixed

Send a test message from the service you fixed to a mailbox you control and check the headers: you want dmarc=pass and a dkim=pass with header.d=example.com or header.i=@example.com. The SPF, DKIM and DMARC checker confirms your DNS records parse correctly. Then watch your aggregate reports for a few days; that source should move from failing to passing.

How to keep it from coming back

• Make "set up custom DKIM" part of the checklist for any new tool that sends email, before it goes live.
• Read your DMARC aggregate reports, or have something alert you when a new source appears or pass rates drop.
• Re-check your SPF lookup count whenever someone adds an include.
• Track DKIM keys and selectors so a rotation doesn't break signing.

When to get help

If your reports show failing sources you can't identify, or you've fixed what you can find and mail is still failing DMARC, it's worth having someone go through the reports and headers with you.

FAQ

Can DMARC fail if SPF and DKIM both pass?

Yes, and it's the most common kind of failure. DMARC needs SPF or DKIM to pass for a domain that aligns with the From address. Passing for your email provider's domain doesn't count.

Do I need both SPF and DKIM to align?

No. One aligned pass is enough. Aim for aligned DKIM on every source, since it survives forwarding, and treat aligned SPF as a backup.

Why does DMARC fail only for forwarded mail?

Forwarding changes the sending IP, which breaks SPF. If DKIM is aligned and the forwarder doesn't modify the message, DMARC still passes. If you only have aligned SPF, forwarded mail fails.

Will DMARC fail on p=none hurt my deliverability?

The policy itself won't. With p=none, receivers handle the mail as they normally would. But unauthenticated mail tends to be treated worse on its own merits, and Gmail and Yahoo require bulk senders to pass DMARC, so failures still cost you.