By Nilesh Maini, founder of EmailQo. Updated November 2026.
Quick answer: DMARC fails when neither SPF nor DKIM aligns with the domain in your visible From address. SPF and DKIM can both pass while DMARC fails, because they passed for a different domain, usually your email provider's. The fix is to make at least one of them pass for your own domain: sign with DKIM using d=yourdomain.com, or set a custom return path (MAIL FROM) on your domain so SPF aligns.
What DMARC actually checks
DMARC (RFC 7489) does not run its own authentication. It takes the results of SPF and DKIM and asks one extra question: did either of them pass for the same domain the reader sees in the From header?
That extra question is called alignment:
- SPF alignment: the domain in the envelope sender (the
Return-Path, also called MAIL FROM) must match the From domain. - DKIM alignment: the
d=domain in the DKIM signature must match the From domain.
DMARC passes if at least one of them passes and aligns. You do not need both.
| SPF result | SPF aligned? | DKIM result | DKIM aligned? | DMARC |
|---|---|---|---|---|
| pass | yes | any | any | pass |
| any | any | pass | yes | pass |
| pass | no | pass | no | fail |
| fail | n/a | fail | n/a | fail |
Row 3 is the one that confuses people: 2 green checks, still a DMARC fail.
Relaxed vs strict alignment
DMARC has two alignment modes, set by the aspf and adkim tags:
- Relaxed (
r, the default): the organizational domains must match.mail.example.comaligns withexample.com. - Strict (
s): the domains must match exactly.mail.example.comdoes not align withexample.com.
Most senders should leave alignment relaxed. Strict alignment is a common source of self-inflicted failures when you send from a subdomain.
How to see why DMARC failed
1. Read the message headers
Send a test email to a Gmail account, open it, then use Show original (desktop). Look at the Authentication-Results header:
Authentication-Results: mx.google.com; dkim=pass header.i=@sendprovider.net; spf=pass smtp.mailfrom=bounces.sendprovider.net; dmarc=fail (p=NONE) header.from=yourdomain.com Here both pass, but for sendprovider.net, while the From domain is yourdomain.com. Nothing aligns, so DMARC fails.
2. Check your DNS records
# Your DMARC policy dig +short TXT _dmarc.yourdomain.com # Your SPF record dig +short TXT yourdomain.com | grep spf1 # A DKIM key (replace the selector with the one in your DKIM-Signature header, s=) dig +short TXT selector1._domainkey.yourdomain.com The DKIM selector is in the s= tag of the DKIM-Signature header of a real message. Guessing selectors wastes time; read it from the header.
The 6 most common causes of DMARC failure (and the fix)
1. Your provider signs DKIM with its own domain
Symptom: dkim=pass header.i=@provider-domain, not your domain.
Fix: set up custom DKIM in your provider's dashboard. It gives you CNAME or TXT records to publish under your domain. Once those verify, messages are signed with d=yourdomain.com and DKIM aligns.
2. SPF passes for the provider's bounce domain
Symptom: spf=pass smtp.mailfrom=bounces.provider.com.
Fix: configure a custom MAIL FROM (return path) on a subdomain of yours, for example bounce.yourdomain.com, and publish the MX and SPF records your provider gives you. With relaxed alignment, bounce.yourdomain.com aligns with yourdomain.com.
On Amazon SES this is the "custom MAIL FROM domain" setting. Without it, SES uses an amazonses.com return path, so SPF can never align and you depend entirely on DKIM.
3. Strict alignment with a subdomain
Symptom: your DMARC record has aspf=s or adkim=s, and you send from mail.yourdomain.com or sign as a subdomain.
Fix: remove aspf=s; adkim=s to use relaxed alignment, or make the domains match exactly.
4. Forwarding and mailing lists
Symptom: failures only for some recipients, often universities or mailing lists.
Why: forwarding changes the sending server, which breaks SPF. Mailing lists that add footers or change subjects break DKIM.
Fix: make sure DKIM aligns (it survives plain forwarding much better than SPF). Some failures here are unavoidable, which is one reason to move to p=reject gradually.
5. More than one DMARC record
Symptom: dig returns 2 TXT records at _dmarc.yourdomain.com.
Fix: merge them into one. Receivers treat multiple DMARC records as no policy.
6. A broken or misplaced record
Symptom: no record at _dmarc, or one that does not start with v=DMARC1.
Fix: publish a single TXT record at _dmarc.yourdomain.com:
v=DMARC1; p=none; rua=mailto:dmarc-reports@yourdomain.com Common mistakes: putting it on the root domain, a typo in v=DMARC1, or a DNS provider that adds the domain twice (_dmarc.yourdomain.com.yourdomain.com).
A safe rollout plan
- Start with
p=noneand aruaaddress to collect aggregate reports. Nothing is blocked; you only observe. - Read the reports for 2 to 4 weeks. Find every service sending as your domain: your mailbox provider, your CRM, invoicing tools, your cold email tool.
- Fix alignment for each legitimate source (custom DKIM, custom return path).
- Move to
p=quarantine, optionally withpct=to apply it to a share of mail first. - Move to
p=rejectonce reports show only legitimate, aligned mail.
A longer walkthrough with record examples for cold email senders is in this DMARC setup guide.
Gmail and Yahoo require bulk senders to publish a DMARC record (p=none is enough to meet that requirement) and to align SPF or DKIM (Google sender guidelines).
Quick checklist
- [ ] One DMARC record at
_dmarc.yourdomain.com, starting withv=DMARC1 - [ ] Custom DKIM so
d=is your domain - [ ] Custom return path on your domain if you want SPF to align too
- [ ] Relaxed alignment unless you have a reason for strict
- [ ]
ruareporting address, and someone actually reading the reports
If you want a quick outside view of your records, a free DMARC checker shows the policy, alignment mode and reporting addresses for any domain.
FAQ
Can DMARC fail if SPF and DKIM both pass?
Yes. DMARC needs at least one of them to pass for the same domain as the From address. If both pass for your email provider's domain instead of yours, DMARC fails.
Do I need both SPF and DKIM to align for DMARC to pass?
No. One aligned pass is enough. DKIM alignment is usually the more reliable one because it survives forwarding.
What does dmarc=fail (p=NONE) mean?
The message failed DMARC, but your policy is none, so receivers are not asked to quarantine or reject it. It is a warning you should fix before moving to a stricter policy.
Is p=none enough for Gmail's bulk sender rules?
Yes, Google's requirement is that a DMARC record exists. p=none meets it, as long as SPF or DKIM also aligns.
How long does a DMARC change take to work?
As long as your DNS TTL, often minutes to a few hours. Aggregate reports arrive daily, so allow a few days to see the effect.
