What does a DMARC failure mean?#
DMARC is a rule the receiving mail server applies to you, not something your own software checks before sending. It says: look up a policy on the domain in the From line, and if the message did not pass the authentication that policy requires, do what the policy says. So a failure has one of four shapes, and each one has a different fix.
The other thing to hold onto: DMARC passes or fails a domain, not a person. When a mailing tool sends on your behalf, the tool's own domain is the one that signed the message, and the question becomes whether that signature or that sender line matches your From domain closely enough. That matching is what the protocol calls alignment, and it is where most small senders lose.
How do I fix a DMARC failure?#
- Check a record exists at _dmarc.yourdomain.com. No record means nothing is being asked of you and no policy is being enforced, which is a setup gap rather than a delivery failure.
- Check SPF passes and that the passing domain is your From domain or its parent, not the tool's private domain.
- Check DKIM passes and that the signing domain in the signature matches your From domain.
- Check the record itself is well formed, because a stray character or a second record makes the whole thing unread rather than permissive.
- Only then touch the policy letter, because p=none, p=quarantine and p=reject decide what happens to mail that fails, not whether mail passes.
That order is the whole method. Senders who start at the policy end turn a newsletter off by setting reject on traffic they had not looked at, which is the second most common DMARC incident after the missing record.
What are the four ways a message fails DMARC?#
| The failure | What it means | Where the fix goes |
|---|---|---|
| no record | Your domain publishes no DMARC policy, so nothing is asked and nothing is enforced | DNS, one TXT record at _dmarc |
| spf fail | The server that handed the mail over is not listed as allowed for your domain | Your SPF record, adding the sending service |
| dkim fail | The signature inside the message does not verify, or belongs to another domain | The signing setup in your sending tool, then DNS |
| alignment fail | Both checks may pass, but the domain that passed is not your From domain | Send from your own verified domain rather than a shared one |
| policy is reject | Nothing is broken, but failing mail is now refused rather than delivered | Read the reports before you change the letter |
The last row is not a technical fault and is the one that surprises people. A strict policy applied to traffic that was never examined produces bounced mail that looks like a spam block.
How do I find out which failure is mine?#
Send yourself a message, open it in a mail client that shows the full headers, and read the line that starts Authentication-Results. Gmail and most providers write spf= and dkim= with pass or fail on it, and dmarc= with the verdict and the domain that produced it. That one line tells you which of the four you are in.
If you can read a bounce message, the receiving server often names the failing check and the record it looked up. Microsoft publishes a page of failed-delivery codes from its postmaster addresses, and the code in the message is the shortest route to the cause.
If you have no idea what mail is going out under your domain name at all, that is what the report address in the record is for, and it is the next section.
What is DMARC alignment?#
The protocol compares the domain the reader sees in the From line with the domain that passed SPF or DKIM. Two domains are aligned when they match, and the match can be exact or can allow subdomains, depending on a mode the record sets.
Google states the requirement plainly in its own sender guidelines: for direct email, the domain in the sender's From header must be aligned with either the SPF domain or the DKIM domain, and this is what it takes to pass DMARC alignment. Passing SPF on someone else's domain is not enough, which is the trap in a lot of cheap sending setups.
How do I fix DMARC alignment?#
- Send from a domain you own and have verified with the sending tool, so the message is signed by your domain rather than a shared one.
- Keep the From address, the reply address and the signing domain under the same parent domain, since a different parent reads as unaligned.
- If you send from a subdomain, publish the record for that subdomain or set the subdomain policy deliberately rather than leaving it to the default.
- When the tool must use its own sending domain, use the custom MAIL FROM or return-path option it offers so the SPF side aligns with your domain too.
- Stop sending marketing mail from a personal mailbox, because you cannot edit the records that decide it.
The second option is where real time goes. A record on example.com governs mail from example.com, and a subdomain with its own sending setup can pass or fail independently of the parent, so a campaign sent from news.yourbrand.com needs that name accounted for.
What should my DMARC record say?#
One TXT record at _dmarc.yourdomain.com. The protocol defines the tags, and a working starting point uses the observation policy with a report address you read.
| Tag | What it does | What to put |
|---|---|---|
| v | Names the version of the protocol | DMARC1, always first |
| p | What to do with mail from this domain that fails | none at first, then quarantine, then reject |
| sp | The same decision for subdomains | Leave out to follow p, or set it on purpose |
| rua | Where aggregate reports go | A mailbox you read, or the tool's report address |
| ruf | Where individual failure reports go | Optional, and often left out |
| pct | What share of failing mail the policy applies to | A rollout dial, and it must not apply to reports |
| adkim, aspf | Whether matching is strict or relaxed | r is relaxed and is the usual choice |
| fo | Which results to report | Leave out unless you want every detail |
The RFC is clear that pct exists so a domain owner can enforce slowly instead of all at once, and that reports must keep arriving whatever the percentage says. That is the safe route into a strict policy.
How do I read a DMARC aggregate report?#
They arrive as XML attachments, one file per reporting server per period, grouped by source IP, with counts of how much mail passed or failed and which checks did it. Nobody reads the raw file by eye. You either point rua at the mailbox your sending tool watches, or you use a free reader that turns the files into a table.
What you are looking for is a list of everything that claims to be from your domain. Some of it is you, some of it is a tool you forgot about, some of it is somebody else, and the protocol expects all three in the same file. The RFC notes that a domain owner asking for reports will receive information about mail that was not in fact from them, which is the point of asking.
Practical sequence: read the report for two weeks under p=none, find every source that is yours, make each one pass, and only then raise the policy. A sending tool that shows you the same picture in its own dashboard saves you the XML.
What is the difference between p=none, p=quarantine and p=reject?#
| Policy | What a receiver does with failing mail | When to use it |
|---|---|---|
| p=none | Delivers it as normal and keeps reporting it to you | While you are still learning what sends under your name |
| p=quarantine | Treats it as suspicious, usually junk | Once every source you recognise passes |
| p=reject | Refuses it, and the sender gets a failure notice | When you are confident nothing legitimate is unauthenticated |
Yahoo puts the same advice in its own sender FAQ with a reason: if you have a spoofing problem you should be implementing an enforcement policy of quarantine or reject regardless of anything else, because failing to do it leaves somebody else's mail looking like yours.
How do I fix a DMARC policy not enabled warning?#
That message means a checker looked for the record and did not find one, or found one it could not parse. Three causes, in order of how often they turn up: nobody published a record, the record went at the wrong name, or the domain was typed as a subdomain that has no record of its own.
- Publish a TXT record at _dmarc.plus your exact From domain, not at the domain alone.
- Keep it to one record. Two records at the same name are read as none.
- Start with p=none plus a rua address, then confirm a checker finds it before you change anything else.
- If the warning names a subdomain, either give that subdomain its own record or set the subdomain policy on purpose.
Quote from the record matters. A missing semicolon, a stray quote or a v tag not first will make a validator report a policy problem when the real issue is that the record cannot be read at all.
My record is set to reject and mail is bouncing. What now?#
Lower it, do not delete it. Set p=none for a defined window, keep the report address running, and find the sources that fail. The usual ones are a second tool you still send from, a mailbox your accountant uses for statements, a form on your website that mails through an old service, and forwarded mail that could not have passed.
Then fix each source rather than the letter, and step to quarantine before reject. A pct value lets you enforce on a share of traffic while you check the consequences, and the protocol requires that reports keep flowing during that window.
If a specific campaign fails and one-to-one mail passes, read the forwarding section below, because that pattern is nearly always an intermediary rewriting the message.
Why does my newsletter fail when my personal mail passes?#
Because one-to-one mail travels from your provider's servers, which are already in your SPF record and sign with your domain, and a newsletter travels from a sending service that is neither unless you set it up.
Two things then happen at once. The handover comes from an IP your record does not authorise, so SPF fails. And the signature belongs to the tool rather than to you, so DKIM passes on the wrong domain. Neither is a bug and both are fixed in your DNS and in the tool, which is exactly what the alignment section covers.
What breaks DMARC for forwarded mail?#
A forwarder takes your message, re-homes it on its own server and hands it over again. The new server is not in your SPF record, so the check that passed originally now fails. If the forwarder also edits the message, adding a tag to the subject or a footer to the body, the DKIM signature no longer matches the bytes it covered and that fails too.
This is why the RFC warns that forwarding arrangements show up in your reports: mail forwarded into other domains appears against your domain name even though you never chose that path. The fix is not a stronger policy. It is sending to addresses that do not forward, and letting your suppression list handle the ones that fail.
Do I need DMARC to send to Gmail or Yahoo?#
Google requires SPF or DKIM of every sender, and requires SPF, DKIM and DMARC of a bulk sender, which its own guidelines define by volume at more than 5,000 messages a day to Gmail accounts. Yahoo describes its enforcement as starting in February 2024 and applies to a sender it judges to be sending a significant volume, without publishing a number.
Both say what happens if you miss the requirements rather than pretending it is harmless. Yahoo states that mail which does not meet them may go to spam or be rejected, and that a rejection comes back with a specific error code. Google's guidance is the one to read if Gmail is where your readers live.
If you mail five thousand people once a month you are not the sender either definition is talking about, and you are still better off aligned, because alignment is also what makes your own domain the one that earns or loses trust.
What if I send from a Gmail or Outlook address?#
Then you cannot fix it, because the records that decide the outcome belong to somebody else. A personal address has its provider's SPF, its provider's signature and its provider's policy, and none of them authorise a marketing tool to send as you.
That is not a reason to give up on the list, it is a reason to move the sending onto a domain you control. The work is one verification and two DNS entries, and it is the difference between renting somebody else's reputation and building your own. What SPF, DKIM and DMARC are covers the three records from the beginning.
How long does a DMARC fix take to work?#
A DNS change is visible to a receiving server as soon as that server's cached copy expires, and the cache life is set by the record itself, so minutes to a few hours is the normal shape. There is no queue to flush and no approval to wait for.
The part that takes longer is proving it. Aggregate reports arrive on each receiver's own schedule rather than instantly, so the honest window for seeing a clean picture is a fortnight of sends rather than one test message.
How do I test DMARC before sending a campaign?#
- Send a test message to a Gmail address, show the original and read the dmarc result on the Authentication-Results line.
- Send one to an address at each big provider your list contains, because a pass at one is not a pass at the other.
- Check the From address you are about to use is the one you verified, since a reply-to or an old default can move the whole question to another domain.
- Look at the last campaign's bounce notes before you mail again, which is where a new failure shows up first.
A pre-send check that reads your own records and tells you before the send is the cheap version of this. Waiting for the report is the expensive version.
Campaign Kicker verifies your own domain in your DNS and signs your mail with it, so the passing domain and the From domain are the same one. The Domain tab shows what is set, what is missing and what a receiver will read, and the pre-send check refuses to mail an address with no consent behind it. The free plan mails 5,000 emails a month, no card.
Send from your own domain