Why does DMARC fail? Causes and fixes for dmarc=fail

A message shows dmarc=fail even though SPF or DKIM says pass. Or a service you pay for keeps landing in junk after you tightened your policy. DMARC failures almost always come down to one idea, alignment, and a short list of causes. This guide shows how to find which one you have and how to fix it.

Why does DMARC fail when SPF or DKIM passes?

Because DMARC doesn't ask "did SPF or DKIM pass?" It asks "did SPF or DKIM pass for your domain?"

RFC 9989 section 5.3.5 says a message passes if one or more authenticated identifiers align with the domain in the From header. If none exist, or none align, it fails. The two identifiers are:

• SPF: the MAIL FROM (envelope sender, often visible as Return-Path) domain, if SPF passed for it.
• DKIM: the d= domain of each DKIM signature that verified.

A newsletter platform can pass SPF for bounces.platform.example and pass DKIM for d=platform.example. Both pass. Neither is your domain, so DMARC fails. Microsoft's troubleshooting table describes exactly this: "SPF passes for adatum.com but DMARC fails" because the MAIL FROM "uses the service's domain" and there's "no DKIM signing with your domain" (Microsoft Learn).

Relaxed vs strict alignment

Relaxed alignment only needs the same organizational domain. If you've set adkim=s or aspf=s, subdomain senders will fail. RFC 9989 notes that "nearly all Domain Owners have found relaxed alignment sufficient."

How do I diagnose a DMARC failure from the headers?

You need the full headers of a message that failed. Ask the recipient to forward it as an attachment, or send a test to a mailbox you control. Then:

1. Find Authentication-Results. It's added by the receiving server and defined in RFC 8601. Paste the headers into our Email Header Analyzer, which runs in your browser, or follow how to read email headers.
2. Note header.from. That's the domain DMARC protects.
3. Note smtp.mailfrom and the spf= result. Does SPF pass, and does that domain align with header.from?
4. Note header.d and the dkim= result for each signature. Does any passing signature's domain align?
5. Read the dmarc= result and action. Microsoft shows, for example, action=oreject when the sender publishes p=reject.

Microsoft's own example shows a message where both checks pass and DMARC still fails:

Authentication-Results: spf=pass (sender IP is 198.51.100.10)
  smtp.mailfrom=bounces.adatum.com; dkim=pass (signature was verified)
  header.d=adatum.com; dmarc=fail action=oreject
  header.from=contoso.com;compauth=fail reason=000

Neither bounces.adatum.com nor adatum.com shares an organizational domain with contoso.com. Diagnosis: alignment, not authentication.

If you don't have a failed message to hand, our Email Deliverability Test lets you send one email and see its SPF, DKIM and DMARC results.

How do you diagnose DMARC failures from aggregate reports?

Headers show one message. Aggregate reports show every source. In each record, compare two blocks:

• policy_evaluated holds the DMARC view: dkim and spf here mean aligned pass or fail.
• auth_results holds the raw results: the domain each check ran against and whether it passed.

Microsoft sums up the key pattern: <auth_results><spf><result>pass</result> with <policy_evaluated><spf>fail</spf> means "SPF passed but domains don't align." Load your reports into the DMARC Report Analyzer to see this per source without reading XML.

What are the common causes of DMARC failure?

Third-party senders

This is one of the most common causes. Google's DMARC guide says to contact each provider "to make sure SPF and DKIM are correctly set up" and to "make sure the provider's envelope sender domain matches your domain" (Google Workspace Admin Help).

Microsoft's decision path is practical:

1. Can the service use your domain in MAIL FROM? Then configure that, and SPF aligns.
2. If not, can it sign DKIM with d= set to your domain? Then configure custom DKIM.
3. If neither, send from a subdomain and have the service sign as that subdomain.

DKIM is the better of the two, because it survives forwarding. Our SPF records by provider pages show what each service needs, for example SendGrid, Mailchimp and Amazon SES.

Forwarding and mailing lists

RFC 9989 section 7.4 explains that forwarded mail "will most likely fail SPF checks unless the RFC5321.MailFrom address is rewritten," while "DKIM signatures will generally remain valid." It then requires that domains publishing p=reject "MUST NOT rely solely on SPF" and "MUST apply valid DKIM signatures."

Mailing lists are harder: they often add a subject tag or footer, which breaks DKIM. RFC 9989 notes that mailing list software has adopted workarounds that make the From line aligned, for example by using the list's own address. If your users post to lists, read why email forwarding breaks SPF and DMARC.

Subdomains

Subdomain mail can fail for two reasons. Strict alignment rejects it, or the subdomain has its own DMARC record you forgot about. Microsoft also notes that each sending subdomain "requires an SPF and DKIM record for DMARC." See DMARC subdomain policy.

DKIM d= mismatch in Microsoft 365

If a Microsoft 365 message carries a DKIM signature from your *.onmicrosoft.com domain instead of your own, it can pass DKIM and still fail DMARC. Microsoft's alignment table lists contoso.onmicrosoft.com against From contoso.com as a fail in both relaxed and strict mode. Microsoft says custom domains need DKIM signing "using the custom domain or subdomain so the domain that's used to sign the message aligns with the domain in the From address." Our DKIM setup guide walks through it.

What do DMARC bounce messages mean?

When the sender's policy is reject, the failure often comes back as a bounce:

• Microsoft 365: 550 5.7.509 Access denied, "sending domain does not pass DMARC verification and has a DMARC policy of reject."
• Outlook.com, for high-volume senders whatever their policy: 550 5.7.515, "sending domain does not meet the required authentication level." Microsoft requires these senders to pass DMARC.
• Gmail: 550 5.7.26, including "Unauthenticated email from <domain> is not accepted due to domain's DMARC policy."

Look up any other code with our SMTP Error Code Lookup.

Should I relax my policy while I fix it?

Be careful. Switching to p=none stops protecting your domain for every message, not just the broken stream. If real customers are affected, a short step back may be justified. A narrower option is RFC 9989's t=y flag, which applies your policy one level down while you test. DMARC record examples shows the record.

Next steps

1. Get the full headers of a failing message and run them through the Email Header Analyzer.
2. Compare header.from with smtp.mailfrom and header.d. If neither aligns, fix the sender's DKIM or MAIL FROM.
3. Check your DNS with the DMARC Checker, SPF Checker and DKIM Checker.
4. Load a week of aggregate reports into the DMARC Report Analyzer to find every other failing source.

New to DMARC? Start with what is DMARC. And if forged mail is reaching your own users, an inbound filter such as iBlockSpam screens for spam, phishing and spoofing before delivery; see how it works.

To see which senders fail day by day without opening XML files, iBlockSpam's DMARC monitoring groups your report data by sender and marks what needs fixing.

Browse our other SPF, DKIM and DMARC guides.