Why it matters
DMARC uses OR logic: one aligned pass (SPF or DKIM) is enough to pass, so a fail means every authenticated identity is misaligned. Under a p=quarantine or p=reject policy, receivers will then junk or outright bounce your legitimate mail, and forwarded or third-party-sent messages disappear. It is also a security signal: a persistent fail leaves your domain spoofable, because you cannot safely enforce reject until your own legitimate streams align. This is governed by RFC 7489: Domain-based Message Authentication, Reporting, and Conformance (DMARC).
Common causes
- Third-party/ESP sending: the platform sets its own bounce/Return-Path domain (e.g. bounces.sendgrid.net), so SPF passes for the ESP, not for your From domain, no SPF alignment.
- DKIM signed with the ESP's d= domain (e.g. d=mailchimpapp.net) instead of a d= on your own domain, so DKIM passes but is unaligned.
- Missing or broken DKIM entirely (selector CNAME/TXT not published), leaving SPF alignment as the only path, which then also fails for relayed or forwarded mail.
- Forwarding and mailing lists: forwarders break SPF (new envelope sender) and list servers alter the body/Subject, breaking the DKIM signature, so both fail at the destination.
- SPF PermError from exceeding RFC 7208 limits: more than 10 DNS-querying mechanisms across the full recursive expansion (each include:_spf.google.com alone costs ~4), or more than 2 void lookups: a PermError is not a pass, so SPF contributes no alignment.
- Strict alignment (aspf=s / adkim=s) set while mail legitimately sends from a subdomain, so a relaxed match that would have passed is rejected.
- Header From uses a different organizational domain than the one SPF/DKIM authenticate (e.g. sending as @brand.com but signing/enveloping as @brandmail.com).
How to fix Why DMARC Is Failing
- Read your DMARC aggregate (RUA) XML reports: they show, per source IP, whether SPF and DKIM passed and whether each was aligned. Fix the specific stream that shows 'pass' but 'fail' on alignment; do not guess.
- For DKIM alignment (the durable fix, survives forwarding): configure each sender to sign with a d= on your own domain. Publish the provider's DKIM selector as a CNAME/TXT under your domain (e.g. s1._domainkey.example.com) so the signature's d= is example.com, matching the From domain.
- For SPF alignment: set the sender's Return-Path/bounce (envelope) domain to a domain you own that shares your organizational domain - many ESPs call this a custom MAIL FROM, custom bounce domain, or 'via' domain - then publish the required SPF include for it.
- Audit your SPF record and count DNS-querying mechanisms (include, a, mx, ptr, exists, redirect) across the full recursive expansion; keep the total at or under 10 and void lookups at or under 2. Remove includes for senders you no longer use.
- If still over 10 lookups, consolidate: move some senders onto a delegated subdomain with its own SPF record (spreads the lookup budget), or use SPF flattening - replacing includes with resolved IP ranges - accepting the trade-off that flattened IPs go stale when the provider changes them and must be re-synced.
- Prefer relaxed alignment (aspf=r; adkim=r, the defaults) unless you have a specific reason for strict; strict rejects legitimate subdomain sends that relaxed would allow.
- Confirm the visible From domain matches the domain you aligned SPF/DKIM to. Send test messages and verify Authentication-Results shows dmarc=pass with an aligned identifier before ratcheting policy.
- Roll the policy up gradually: p=none (monitor) then p=quarantine then p=reject, watching RUA reports at each step so you never enforce reject while a legitimate stream is still misaligned.
Frequently asked questions
SPF passes and DKIM passes, so why does DMARC still fail?
Because DMARC requires alignment, not just authentication. SPF can pass for the ESP's Return-Path domain and DKIM can pass with the ESP's d= domain, yet if neither of those domains matches your From header domain (under relaxed or strict mode), DMARC sees zero aligned passes and fails.
Do I need both SPF and DKIM to align?
No. DMARC uses OR logic, one aligned pass is enough. In practice you want aligned DKIM as the primary path because it survives forwarding and relays, while SPF alignment breaks whenever the envelope sender is rewritten.
What is the difference between relaxed and strict alignment?
Relaxed (the default) requires the same organizational/registered domain, so mail.example.com aligns with example.com. Strict requires an exact, character-for-character domain match. Use relaxed unless you have a specific reason not to.
Why does DMARC fail on forwarded email even though I set everything up?
Forwarding rewrites the envelope sender, so SPF now passes for the forwarder (unaligned) or fails. Aligned DKIM is what saves forwarded mail: as long as the forwarder doesn't modify the signed headers or body, the DKIM signature and its aligned d= domain still validate at the final destination.