dmarc=fail

dmarc=fail means the receiver could not authenticate your message under DMARC: neither SPF nor DKIM both passed and aligned with your From domain. Here is why it appears, what it costs you, and how to fix it.

Check your domain free → Jump to the fix ↓

What it means

The cause.

dmarc=fail is a result a receiver writes into the Authentication-Results header of your message. It is not an SMTP reply code and not a DNS error — it is the receiver reporting the outcome of its DMARC check. DMARC passes only when at least one of SPF or DKIM passes and is aligned with the domain in your visible From: address. When neither satisfies both conditions, the result is fail.

Alignment is the part most people miss. SPF can pass for your Return-Path (envelope sender) and DKIM can carry a valid signature, yet DMARC still fails if the domain those checks authenticate does not match your From: domain. SPF aligns when the Return-Path domain matches the From: domain; DKIM aligns when the signature d= domain matches it. In relaxed mode the organisational domains must match; in strict mode the full domains must match exactly. A pass on an unrelated domain — a mailbox provider's bounce domain, a marketing tool's own signing domain — counts for nothing under DMARC.

So dmarc=fail resolves to one of a few concrete situations: SPF failed and DKIM was absent or broken; both mechanisms passed but on domains that do not align with your From:; or the message was forwarded or relayed in a way that broke SPF and stripped or invalidated the DKIM signature. The header usually shows the pieces — for example spf=pass and dkim=none, or spf=fail and dkim=fail — which tells you which leg to repair.

Why it matters

The impact.

What dmarc=fail does to the message depends on the policy you publish. Under p=none the message is still delivered and you only see the failure in your DMARC aggregate reports, but you are getting no protection. Under p=quarantine it lands in spam, and under p=reject it is bounced outright. Either way, a failing message is unauthenticated in the receiver's eyes and treated as potentially spoofed.

Since February 2024 Gmail, Yahoo and Microsoft require bulk senders to pass DMARC with alignment. A persistent dmarc=fail from these receivers means mail that used to arrive quietly starts hitting spam or being rejected, and as enforcement tightened through 2025 the tolerance for unauthenticated bulk mail dropped further. Fixing the alignment is the difference between reaching the inbox and being filtered.

What to do

The fix, in order.

Work top to bottom, then re-check — DNS changes take a few minutes to take effect.

1 Read the Authentication-Results header. Open a failing message and find the Authentication-Results line. It shows spf=, dkim= and dmarc= side by side. If you see spf=pass dkim=none, DKIM is your gap; if both pass but dmarc still fails, the problem is alignment, not authentication. This tells you exactly which leg to repair rather than guessing.
2 Check your domain with the DMARC checker. Run your domain through the DMARC checker. It reports your published policy, confirms whether SPF and DKIM are set up to align with your From: domain, and flags whether you are relying on a mechanism that authenticates the wrong domain.
3 Fix the failing leg. If SPF fails, make sure the sending service is listed in your SPF record and that your Return-Path domain aligns with your From: domain. If DKIM is missing or broken, enable DKIM signing at your sending provider and publish the DKIM public key they give you. You need at least one of the two to pass and align.
4 Align the passing mechanism with your From domain. A pass alone is not enough. For DKIM, sign with a d= domain that matches your From: domain (or its organisational domain). For SPF, use a Return-Path on your own domain rather than the provider's shared bounce domain. Relaxed alignment only needs the organisational domains to match, which most setups can satisfy.
5 Account for forwarding. Forwarding breaks SPF and can invalidate DKIM if the message is modified in transit. You cannot control every forwarder, but a valid, aligned DKIM signature survives most forwarding paths where SPF does not — so ensure DKIM is your reliable passing leg rather than depending on SPF alone.
6 Send a test and re-check. After the DNS and provider changes propagate, send a fresh message to an address you control, open the Authentication-Results header, and confirm dmarc=pass. Watch your DMARC aggregate reports over the following days to confirm the fix holds across real traffic.

Confirm the error is gone.

Run a full check on your domain — it reads SPF, DKIM and DMARC live and tells you, in plain terms, whether the thing behind this error is fixed. Free, no account.

Check your domain → Or send a test email

Common questions

About this error.

What does dmarc=fail mean? It is a receiver reporting, in the Authentication-Results header, that your message did not pass DMARC. DMARC passes only when SPF or DKIM both passes and aligns with your From: domain, so fail means neither did. It is an authentication result, not an SMTP code.

Why does DMARC fail when SPF and DKIM pass? Because DMARC also requires alignment. SPF passing for your Return-Path or DKIM signing with a provider's own domain does not help if that domain does not match your visible From: domain. Without alignment, a pass counts for nothing under DMARC.

How do I fix dmarc=fail? Read the Authentication-Results header to see which leg failed, then repair it: list your sender in SPF and align the Return-Path, or enable DKIM signing with a d= domain that matches your From:. You only need one of the two to pass and align. Then send a test and confirm dmarc=pass.

Is dmarc=fail permanent? The result itself is not a permanent SMTP error — it is reported per message. It will keep recurring on every message until you fix the underlying SPF or DKIM alignment problem, and whether the message is delivered, spam-filtered or rejected depends on your DMARC policy.

What is DMARC alignment? Alignment means the domain an authentication check validates matches your From: domain. SPF aligns when the Return-Path domain matches; DKIM aligns when the signature d= domain matches. Relaxed mode compares organisational domains; strict mode requires an exact match.

Does forwarding cause dmarc=fail? It can. Forwarding changes the envelope sender, which breaks SPF, and any modification in transit can invalidate DKIM. A valid, aligned DKIM signature survives most forwarding where SPF does not, so relying on DKIM as your passing leg reduces forwarding failures.

Fix the cause, and check it.

DMARC checker → Grade your policy and how strictly it aligns SPF and DKIM. Google Workspace setup → The exact SPF, DKIM and DMARC records for Google Workspace. Microsoft 365 setup → The SPF line, the two DKIM CNAMEs, and the DMARC record.