DMARC fail: causes and fixes

Read the headers first

Open the failing message and view the original source. Look for the Authentication-Results header added by the receiver:

Authentication-Results: mx.google.com; dkim=pass header.d=mailer.example.net; spf=pass smtp.mailfrom=bounce.mailer.example.net; dmarc=fail (p=QUARANTINE) header.from=yourdomain.com

In this example both SPF and DKIM passed, but for mailer.example.net, not yourdomain.com. That is an alignment failure, the most common cause.

Common causes

Cause	Fix
Third-party sender signs with its own domain	Enable custom DKIM / domain authentication in that service so d= is your domain
Return-Path is the provider's domain	Use a custom bounce/Return-Path domain (a CNAME on a subdomain), or rely on aligned DKIM
Service not in SPF and no DKIM	Add DKIM; add its include to SPF if it uses your Return-Path
Forwarding	SPF breaks on forwarding; aligned DKIM normally survives. Ask the forwarder to use SRS/ARC
Mailing lists modify messages	Subject tags or footers break DKIM. Many lists rewrite From; ARC helps receivers trust the list
Strict alignment (adkim=s / aspf=s)	Subdomains no longer count as aligned; use relaxed unless you need strict
Spoofing	Working as intended: DMARC is blocking someone else using your domain

Use aggregate reports

Your rua reports group results by source IP with SPF and DKIM results and the domains they authenticated. Sort by volume: high-volume sources that fail are almost always a legitimate service missing DKIM. Low-volume unknown IPs are often spoofing or forwarding.

Checklist

1. Run the domain health check to confirm SPF, DKIM and DMARC records are valid.
2. For each sending service, check its DKIM selector with the DKIM checker.
3. Keep SPF under 10 lookups; a permerror makes SPF fail everywhere.
4. Send a test to a Gmail address and confirm dmarc=pass in the headers.

Frequently asked questions

Related tools