By Nilesh Maini, founder of EmailQo. Updated November 2026.

Quick answer: DMARC fails when neither SPF nor DKIM aligns with the domain in your visible From address. SPF and DKIM can both pass while DMARC fails, because they passed for a different domain, usually your email provider's. The fix is to make at least one of them pass for your own domain: sign with DKIM using d=yourdomain.com, or set a custom return path (MAIL FROM) on your domain so SPF aligns.

What DMARC actually checks

DMARC (RFC 7489) does not run its own authentication. It takes the results of SPF and DKIM and asks one extra question: did either of them pass for the same domain the reader sees in the From header?

That extra question is called alignment:

  • SPF alignment: the domain in the envelope sender (the Return-Path, also called MAIL FROM) must match the From domain.
  • DKIM alignment: the d= domain in the DKIM signature must match the From domain.

DMARC passes if at least one of them passes and aligns. You do not need both.

SPF result SPF aligned? DKIM result DKIM aligned? DMARC
pass yes any any pass
any any pass yes pass
pass no pass no fail
fail n/a fail n/a fail

Row 3 is the one that confuses people: 2 green checks, still a DMARC fail.

Relaxed vs strict alignment

DMARC has two alignment modes, set by the aspf and adkim tags:

  • Relaxed (r, the default): the organizational domains must match. mail.example.com aligns with example.com.
  • Strict (s): the domains must match exactly. mail.example.com does not align with example.com.

Most senders should leave alignment relaxed. Strict alignment is a common source of self-inflicted failures when you send from a subdomain.

How to see why DMARC failed

1. Read the message headers

Send a test email to a Gmail account, open it, then use Show original (desktop). Look at the Authentication-Results header:

Here both pass, but for sendprovider.net, while the From domain is yourdomain.com. Nothing aligns, so DMARC fails.

2. Check your DNS records 

# Your DMARC policy dig +short TXT _dmarc.yourdomain.com # Your SPF record dig +short TXT yourdomain.com | grep spf1 # A DKIM key (replace the selector with the one in your DKIM-Signature header, s=) dig +short TXT selector1._domainkey.yourdomain.com

The DKIM selector is in the s= tag of the DKIM-Signature header of a real message. Guessing selectors wastes time; read it from the header.

The 6 most common causes of DMARC failure (and the fix)

1. Your provider signs DKIM with its own domain

Symptom: dkim=pass header.i=@provider-domain, not your domain.
Fix: set up custom DKIM in your provider's dashboard. It gives you CNAME or TXT records to publish under your domain. Once those verify, messages are signed with d=yourdomain.com and DKIM aligns.

2. SPF passes for the provider's bounce domain

Symptom: spf=pass smtp.mailfrom=bounces.provider.com.
Fix: configure a custom MAIL FROM (return path) on a subdomain of yours, for example bounce.yourdomain.com, and publish the MX and SPF records your provider gives you. With relaxed alignment, bounce.yourdomain.com aligns with yourdomain.com.

On Amazon SES this is the "custom MAIL FROM domain" setting. Without it, SES uses an amazonses.com return path, so SPF can never align and you depend entirely on DKIM.

3. Strict alignment with a subdomain

Symptom: your DMARC record has aspf=s or adkim=s, and you send from mail.yourdomain.com or sign as a subdomain.
Fix: remove aspf=s; adkim=s to use relaxed alignment, or make the domains match exactly.

4. Forwarding and mailing lists

Symptom: failures only for some recipients, often universities or mailing lists.
Why: forwarding changes the sending server, which breaks SPF. Mailing lists that add footers or change subjects break DKIM.
Fix: make sure DKIM aligns (it survives plain forwarding much better than SPF). Some failures here are unavoidable, which is one reason to move to p=reject gradually.

5. More than one DMARC record

Symptom: dig returns 2 TXT records at _dmarc.yourdomain.com.
Fix: merge them into one. Receivers treat multiple DMARC records as no policy.

6. A broken or misplaced record

Symptom: no record at _dmarc, or one that does not start with v=DMARC1.
Fix: publish a single TXT record at _dmarc.yourdomain.com:

v=DMARC1; p=none; rua=mailto:dmarc-reports@yourdomain.com

Common mistakes: putting it on the root domain, a typo in v=DMARC1, or a DNS provider that adds the domain twice (_dmarc.yourdomain.com.yourdomain.com).

A safe rollout plan

  1. Start with p=none and a rua address to collect aggregate reports. Nothing is blocked; you only observe.
  2. Read the reports for 2 to 4 weeks. Find every service sending as your domain: your mailbox provider, your CRM, invoicing tools, your cold email tool.
  3. Fix alignment for each legitimate source (custom DKIM, custom return path).
  4. Move to p=quarantine, optionally with pct= to apply it to a share of mail first.
  5. Move to p=reject once reports show only legitimate, aligned mail.

A longer walkthrough with record examples for cold email senders is in this DMARC setup guide.

Gmail and Yahoo require bulk senders to publish a DMARC record (p=none is enough to meet that requirement) and to align SPF or DKIM (Google sender guidelines).

Quick checklist

  • [ ] One DMARC record at _dmarc.yourdomain.com, starting with v=DMARC1
  • [ ] Custom DKIM so d= is your domain
  • [ ] Custom return path on your domain if you want SPF to align too
  • [ ] Relaxed alignment unless you have a reason for strict
  • [ ] rua reporting address, and someone actually reading the reports

If you want a quick outside view of your records, a free DMARC checker shows the policy, alignment mode and reporting addresses for any domain.

FAQ

Can DMARC fail if SPF and DKIM both pass?
Yes. DMARC needs at least one of them to pass for the same domain as the From address. If both pass for your email provider's domain instead of yours, DMARC fails.

Do I need both SPF and DKIM to align for DMARC to pass?
No. One aligned pass is enough. DKIM alignment is usually the more reliable one because it survives forwarding.

What does dmarc=fail (p=NONE) mean?
The message failed DMARC, but your policy is none, so receivers are not asked to quarantine or reject it. It is a warning you should fix before moving to a stricter policy.

Is p=none enough for Gmail's bulk sender rules?
Yes, Google's requirement is that a DMARC record exists. p=none meets it, as long as SPF or DKIM also aligns.

How long does a DMARC change take to work?
As long as your DNS TTL, often minutes to a few hours. Aggregate reports arrive daily, so allow a few days to see the effect.