DMARC guide

DMARC fail: why it happens and how to fix it

Why email fails DMARC even when SPF and DKIM pass, how to find the cause in the headers, and how to fix it for good.

How DMARC decides

DMARC passes when either SPF or DKIM passes and lines up with the domain in your From address. That second part, called alignment, is why email can show spf=pass and dkim=pass and still fail DMARC.

Check	Passes DMARC when
SPF	SPF passes and the domain in the hidden return address matches your From domain
DKIM	DKIM passes and the signing domain (d=) matches your From domain

By default alignment is relaxed, so mail.yourdomain.com lines up with yourdomain.com. If your record says aspf=s or adkim=s, the domains must match exactly.

The usual causes

A service sending as you without your domain set up. Newsletter tools, CRMs and helpdesks often sign with their own domain until you add custom DKIM records for yours.
Forwarding. A forwarded email arrives from a new server, so SPF fails. DKIM usually survives, which is why DKIM matters most.
Mailing lists and footers that change the message break DKIM. See DKIM fail.
A broken SPF record, for example over the 10-lookup limit.
Strict alignment set by mistake.

How to find which one

Open a failing email’s headers. In Gmail, use Show original. Look at the Authentication-Results line: dmarc=fail, then which of spf= and dkim= failed and which domain each checked.

Read your DMARC reports. They list every server sending as you and whether it passed. Unknown senders are either services to fix or someone faking you.

Set up DKIM for your domain in each service. It’s the fix that survives forwarding. Check it with the DKIM checker.

Fix SPF so every service is listed and you’re under 10 lookups, using the SPF checker.

Check your setup

The full scan checks SPF, DKIM and DMARC together and shows what to fix first.