# Why does DMARC fail? Causes and fixes for dmarc=fail

URL: https://iblockspam.com/blog/why-dmarc-fails
Last updated: 2026-10-09
Published: 2026-10-09
Topic: SPF, DKIM & DMARC
Author: iBlockSpam Team

> Troubleshoot dmarc=fail: alignment vs pass, third-party senders, forwarding, subdomains, DKIM d= and SPF MAIL FROM mismatches, with a causes-to-fixes table.

## Short answer

DMARC fails when neither SPF nor DKIM passes for a domain that aligns with the From domain. Common causes are a third-party service using its own bounce or signing domain, missing DKIM, forwarding that breaks SPF, or changes that break DKIM. Compare smtp.mailfrom and header.d with header.from in Authentication-Results, then fix alignment at the sender.

A message shows `dmarc=fail` even though SPF or DKIM says pass. Or a service you pay for keeps landing in junk after you tightened your policy. DMARC failures almost always come down to one idea, alignment, and a short list of causes. This guide shows how to find which one you have and how to fix it.

## Why does DMARC fail when SPF or DKIM passes?

Because DMARC doesn't ask "did SPF or DKIM pass?" It asks "did SPF or DKIM pass **for your domain**?"

[RFC 9989](https://www.rfc-editor.org/rfc/rfc9989.html) section 5.3.5 says a message passes if one or more authenticated identifiers align with the domain in the From header. If none exist, or none align, it fails. The two identifiers are:

- **SPF**: the MAIL FROM (envelope sender, often visible as Return-Path) domain, if SPF passed for it.
- **DKIM**: the `d=` domain of each DKIM signature that verified.

A newsletter platform can pass SPF for `bounces.platform.example` and pass DKIM for `d=platform.example`. Both pass. Neither is your domain, so DMARC fails. Microsoft's troubleshooting table describes exactly this: "SPF passes for adatum.com but DMARC fails" because the MAIL FROM "uses the service's domain" and there's "no DKIM signing with your domain" ([Microsoft Learn](https://learn.microsoft.com/en-us/defender-office-365/email-authentication-dmarc-configure)).

### Relaxed vs strict alignment

| Authenticated domain | From domain | Relaxed (default) | Strict |
|---|---|---|---|
| `example.com` | `example.com` | Aligned | Aligned |
| `bounces.example.com` | `example.com` | Aligned | Not aligned |
| `example.com` | `news.example.com` | Aligned | Not aligned |
| `example.onmicrosoft.com` | `example.com` | Not aligned | Not aligned |
| `platform.example` | `example.com` | Not aligned | Not aligned |

Relaxed alignment only needs the same organizational domain. If you've set `adkim=s` or `aspf=s`, subdomain senders will fail. RFC 9989 notes that "nearly all Domain Owners have found relaxed alignment sufficient."

## How do I diagnose a DMARC failure from the headers?

You need the full headers of a message that failed. Ask the recipient to forward it as an attachment, or send a test to a mailbox you control. Then:

1. **Find `Authentication-Results`.** It's added by the receiving server and defined in [RFC 8601](https://www.rfc-editor.org/rfc/rfc8601.html). Paste the headers into our [Email Header Analyzer](https://iblockspam.com/tools/email-header-analyzer), which runs in your browser, or follow [how to read email headers](https://iblockspam.com/blog/how-to-read-email-headers).
2. **Note `header.from`.** That's the domain DMARC protects.
3. **Note `smtp.mailfrom` and the `spf=` result.** Does SPF pass, and does that domain align with `header.from`?
4. **Note `header.d` and the `dkim=` result** for each signature. Does any passing signature's domain align?
5. **Read the `dmarc=` result and action.** Microsoft shows, for example, `action=oreject` when the sender publishes `p=reject`.

Microsoft's own example shows a message where both checks pass and DMARC still fails:

```
Authentication-Results: spf=pass (sender IP is 198.51.100.10)
  smtp.mailfrom=bounces.adatum.com; dkim=pass (signature was verified)
  header.d=adatum.com; dmarc=fail action=oreject
  header.from=contoso.com;compauth=fail reason=000
```

Neither `bounces.adatum.com` nor `adatum.com` shares an organizational domain with `contoso.com`. Diagnosis: alignment, not authentication.

If you don't have a failed message to hand, our [Email Deliverability Test](https://iblockspam.com/tools/deliverability-test) lets you send one email and see its SPF, DKIM and DMARC results.

## How do you diagnose DMARC failures from aggregate reports?

Headers show one message. [Aggregate reports](https://iblockspam.com/blog/how-to-read-dmarc-reports) show every source. In each record, compare two blocks:

- `policy_evaluated` holds the DMARC view: `dkim` and `spf` here mean **aligned** pass or fail.
- `auth_results` holds the raw results: the domain each check ran against and whether it passed.

Microsoft sums up the key pattern: `<auth_results><spf><result>pass</result>` with `<policy_evaluated><spf>fail</spf>` means "SPF passed but domains don't align." Load your reports into the [DMARC Report Analyzer](https://iblockspam.com/tools/dmarc-report-analyzer) to see this per source without reading XML.

## What are the common causes of DMARC failure?

| Cause | What you see | Fix |
|---|---|---|
| Third-party service uses its own bounce domain | `spf=pass` for the service's domain, SPF not aligned | Set a custom Return-Path / MAIL FROM on your domain at the service |
| Service signs DKIM with its own domain | `dkim=pass header.d=service.example`, not aligned | Enable custom DKIM so `d=` is your domain |
| Service doesn't sign at all | `dkim=none`, SPF not aligned | Turn on DKIM at the service, or stop it sending as your domain |
| Sending server missing from SPF | `spf=fail` or `softfail` | Add the service per its docs; watch the [10-lookup limit](https://iblockspam.com/blog/spf-too-many-dns-lookups) |
| SPF PermError | `spf=permerror` | Fix syntax or reduce DNS lookups |
| DKIM key missing or wrong in DNS | `dkim=fail` or `permerror`, "no key for signature" | Publish the exact key at the right selector; see [find your DKIM selector](https://iblockspam.com/blog/find-dkim-selector) |
| Message changed after signing | `dkim=fail` (some receivers show `neutral`), "body hash did not verify" | Find what modified it; see [DKIM body hash did not verify](https://iblockspam.com/blog/dkim-fail-body-hash-did-not-verify) |
| Forwarding | SPF fails at the final mailbox | Rely on DKIM; ARC at the receiver can help |
| Mailing list rewrote subject or footer | DKIM fails, SPF is the list's | Normal for lists; most lists now rewrite From |
| Strict alignment with subdomain senders | Aligned under `r`, not under `s` | Use `adkim=r` and `aspf=r` |
| Signature from `onmicrosoft.com`, not your domain | `header.d=yourtenant.onmicrosoft.com` | Enable DKIM for your custom domain in Microsoft 365 |
| DNS errors | `dmarc=temperror` or `permerror` | Fix the record; keep exactly one `_dmarc` TXT record |

### Third-party senders

This is one of the most common causes. Google's DMARC guide says to contact each provider "to make sure SPF and DKIM are correctly set up" and to "make sure the provider's envelope sender domain matches your domain" ([Google Workspace Admin Help](https://knowledge.workspace.google.com/admin/security/set-up-dmarc)).

Microsoft's decision path is practical:

1. Can the service use your domain in MAIL FROM? Then configure that, and SPF aligns.
2. If not, can it sign DKIM with `d=` set to your domain? Then configure custom DKIM.
3. If neither, send from a subdomain and have the service sign as that subdomain.

DKIM is the better of the two, because it survives forwarding. Our [SPF records by provider](https://iblockspam.com/spf) pages show what each service needs, for example [SendGrid](https://iblockspam.com/spf/sendgrid), [Mailchimp](https://iblockspam.com/spf/mailchimp) and [Amazon SES](https://iblockspam.com/spf/amazon-ses).

### Forwarding and mailing lists

RFC 9989 section 7.4 explains that forwarded mail "will most likely fail SPF checks unless the RFC5321.MailFrom address is rewritten," while "DKIM signatures will generally remain valid." It then requires that domains publishing `p=reject` "MUST NOT rely solely on SPF" and "MUST apply valid DKIM signatures."

Mailing lists are harder: they often add a subject tag or footer, which breaks DKIM. RFC 9989 notes that mailing list software has adopted workarounds that make the From line aligned, for example by using the list's own address. If your users post to lists, read [why email forwarding breaks SPF and DMARC](https://iblockspam.com/blog/email-forwarding-breaks-spf-dmarc-arc).

### Subdomains

Subdomain mail can fail for two reasons. Strict alignment rejects it, or the subdomain has its own DMARC record you forgot about. Microsoft also notes that each sending subdomain "requires an SPF and DKIM record for DMARC." See [DMARC subdomain policy](https://iblockspam.com/blog/dmarc-subdomain-policy-sp).

### DKIM d= mismatch in Microsoft 365

If a Microsoft 365 message carries a DKIM signature from your `*.onmicrosoft.com` domain instead of your own, it can pass DKIM and still fail DMARC. Microsoft's alignment table lists `contoso.onmicrosoft.com` against From `contoso.com` as a fail in both relaxed and strict mode. Microsoft says custom domains need DKIM signing "using the custom domain or subdomain so the domain that's used to sign the message aligns with the domain in the From address." Our [DKIM setup guide](https://iblockspam.com/blog/dkim-setup-microsoft-365-google-workspace) walks through it.

## What do DMARC bounce messages mean?

When the sender's policy is `reject`, the failure often comes back as a bounce:

- Microsoft 365: [550 5.7.509 Access denied](https://iblockspam.com/smtp-errors/5-7-509-access-denied), "sending domain does not pass DMARC verification and has a DMARC policy of reject."
- Outlook.com, for high-volume senders whatever their policy: [550 5.7.515](https://iblockspam.com/smtp-errors/550-5-7-515), "sending domain does not meet the required authentication level." Microsoft requires these senders to pass DMARC.
- Gmail: [550 5.7.26](https://iblockspam.com/smtp-errors/550-5-7-26), including "Unauthenticated email from <domain> is not accepted due to domain's DMARC policy."

Look up any other code with our [SMTP Error Code Lookup](https://iblockspam.com/tools/smtp-error-codes).

## Should I relax my policy while I fix it?

Be careful. Switching to `p=none` stops protecting your domain for every message, not just the broken stream. If real customers are affected, a short step back may be justified. A narrower option is RFC 9989's `t=y` flag, which applies your policy one level down while you test. [DMARC record examples](https://iblockspam.com/blog/dmarc-record-examples) shows the record.

## Next steps

1. Get the full headers of a failing message and run them through the [Email Header Analyzer](https://iblockspam.com/tools/email-header-analyzer).
2. Compare `header.from` with `smtp.mailfrom` and `header.d`. If neither aligns, fix the sender's DKIM or MAIL FROM.
3. Check your DNS with the [DMARC Checker](https://iblockspam.com/tools/dmarc-checker), [SPF Checker](https://iblockspam.com/tools/spf-checker) and [DKIM Checker](https://iblockspam.com/tools/dkim-checker).
4. Load a week of aggregate reports into the [DMARC Report Analyzer](https://iblockspam.com/tools/dmarc-report-analyzer) to find every other failing source.

New to DMARC? Start with [what is DMARC](https://iblockspam.com/blog/what-is-dmarc). And if forged mail is reaching your own users, an inbound filter such as iBlockSpam screens for spam, phishing and spoofing before delivery; see [how it works](https://iblockspam.com/how-it-works).

To see which senders fail day by day without opening XML files, iBlockSpam's [DMARC monitoring](https://iblockspam.com/features/dmarc-monitoring) groups your report data by sender and marks what needs fixing.

Browse our other [SPF, DKIM and DMARC guides](https://iblockspam.com/blog/topic/authentication).

## Frequently asked questions

### What is the difference between dmarc=fail and dmarc=none?

dmarc=none means the From domain publishes no DMARC record, so there's nothing to evaluate. dmarc=fail means a record exists but no SPF or DKIM pass aligned with the From domain. Fix none by publishing a record; fix fail by making each sender authenticate as your domain.

### How do I fix DMARC failures from a third-party sender?

Turn on custom DKIM signing at the service so it signs with d= set to your domain, and if it offers one, set a custom bounce or Return-Path domain on your domain for SPF alignment. Microsoft lists both as the fix. Adding the service to SPF alone doesn't help if its MAIL FROM is still its own domain.

### Should I lower my DMARC policy when legitimate mail fails?

Only briefly, if real customers are affected and you can't fix the sender quickly. Dropping to p=none removes protection against spoofing for every message. A better route is to fix the failing service, or use t=y test mode on a stricter policy while you work through the reports.

### Why does DMARC fail for only some recipients?

Each receiver evaluates mail independently. Forwarded copies fail SPF at the final mailbox, mailing lists that change the subject or body break DKIM, and DNS timeouts give temporary errors. Aggregate reports from each receiver show which paths fail. Mail that arrives directly usually passes.

### Does relaxed alignment let a subdomain pass DMARC for the main domain?

Yes. Under relaxed alignment, which is the default, a DKIM signature from mail.example.com or a MAIL FROM of bounce.example.com aligns with From example.com, because they share the organizational domain. Strict alignment (adkim=s or aspf=s) requires an exact match.

## Sources

- [RFC 9989: DMARC, sections 4.4 (Identifier Alignment), 5.3.5 and 7.4](https://www.rfc-editor.org/rfc/rfc9989.html)
- [Microsoft Learn: Set up DMARC to validate email in Microsoft 365 (DMARC troubleshooting)](https://learn.microsoft.com/en-us/defender-office-365/email-authentication-dmarc-configure)
- [RFC 8601: Message Header Field for Indicating Message Authentication Status](https://www.rfc-editor.org/rfc/rfc8601.html)
- [RFC 6376: DomainKeys Identified Mail (DKIM) Signatures](https://www.rfc-editor.org/rfc/rfc6376.html)
- [RFC 7208: Sender Policy Framework (SPF)](https://www.rfc-editor.org/rfc/rfc7208.html)
- [Google Workspace Admin Help: Set up DMARC](https://knowledge.workspace.google.com/admin/security/set-up-dmarc)

## Free tools for this guide

- [DMARC Checker](https://iblockspam.com/tools/dmarc-checker): Check your policy, reporting and the safe path from p=none to reject.
- [Email Header Analyzer](https://iblockspam.com/tools/email-header-analyzer): Trace hops and authentication results — runs entirely in your browser.
- [DMARC Report Analyzer](https://iblockspam.com/tools/dmarc-report-analyzer): Read DMARC aggregate reports (XML, gzip or zip): see who sends as your domain and what fails — runs in your browser.
- [DKIM Checker](https://iblockspam.com/tools/dkim-checker): Validate DKIM keys by selector, including key type and strength.

---

Source: iBlockSpam, https://iblockspam.com/blog/why-dmarc-fails (this is a Markdown copy; the HTML page is canonical). Quote with attribution and a link. Site index for AI assistants: https://iblockspam.com/llms.txt