dmarc=fail: why DMARC fails and how to fix it

What dmarc=fail means

dmarc=fail means the receiver could not find an SPF or DKIM pass that aligns with the domain in the From header. DMARC (RFC 7489) needs only one of the two: an SPF pass whose domain matches the From domain, or a DKIM pass whose d= domain matches it. If neither exists, DMARC fails, and the receiver applies the policy you published (p=none, quarantine or reject).

Authentication-Results: mx.google.com;
       dkim=pass header.i=@mailer.example.net header.s=k1;
       spf=pass smtp.mailfrom=bounces.example.net;
       dmarc=fail (p=QUARANTINE sp=QUARANTINE dis=QUARANTINE) header.from=example.com

This sample is the most common case: SPF and DKIM both pass, but for example.net, the sending service's domain, not example.com. Nothing aligns, so DMARC fails. Paste your own headers into the Email Header Analyzer to see each part.

Common causes

Symptom in the header	Cause	Fix
`dkim=pass` with another `d=` domain	Service signs with its own domain	Set up DKIM for your domain in the service
`spf=pass` with another `smtp.mailfrom`	Service uses its own bounce domain	Configure a custom return-path, or rely on DKIM
`dkim=none`	Message not signed at all	Turn on DKIM signing (dkim=none)
`dkim=fail` or `neutral (body hash did not verify)`	Message changed after signing	Find what modifies it (body hash)
`spf=fail` or `softfail`	Sending IP not in your SPF record	Add the service's include (softfail vs fail)
`spf=permerror`	Broken SPF record	Fix lookups or duplicates (too many lookups)

Fixing a third-party sender

Almost every email platform (newsletter tools, CRMs, helpdesks, transactional APIs) has a "domain authentication" or "sender domain" setting. It gives you DNS records to add, usually:

s1._domainkey.example.com.   CNAME  s1.domainkey.esp.example.net.
bounce.example.com.          CNAME  bounces.esp.example.net.

The first makes the service sign with d=example.com (DKIM alignment). The second gives it a return-path under your domain (SPF alignment under relaxed mode). The exact names vary by provider, so copy them from its settings.

Forwarding and mailing lists

When a message is forwarded, the forwarding server's IP isn't in your SPF record, so SPF fails. DKIM normally survives, so a message signed with your domain still passes DMARC. If DKIM also breaks, because a mailing list added a footer or changed the subject, DMARC fails. ARC headers let some receivers trust the original result, but you can't rely on that from the sending side.

Strict alignment

If your record has adkim=s or aspf=s, the domains must match exactly; mail.example.com no longer aligns with example.com. Unless you have a reason, leave both at the default relaxed mode. See DMARC alignment.

What to do first

Read the header.from, smtp.mailfrom and header.i / header.d values in a failing message.
Find which service sent it.
Set up DKIM with your domain in that service and confirm dkim=pass header.d=example.com in a new test message.

DMARC alignment: the matching rules in detail.
DMARC p=reject: what failing mail meets under full enforcement.
550 5.7.26: the bounce Gmail sends for unauthenticated mail.

Check your domain's records with the Email Checker.