Why Does DMARC Fail?
DMARC fails when neither SPF nor DKIM passes with a domain aligned to the visible From address, or when the published policy itself is missing or invalid.
How it works
A simple SPF or DKIM pass is not sufficient unless its authenticated domain aligns with From under relaxed or strict alignment rules.
Alignment is easiest to see with a concrete example. Mail displaying From: example.com can pass SPF for return.mailvendor.example. SPF itself passed, but its authenticated domain is not aligned with example.com, so it does not satisfy DMARC through SPF. If the message has a valid DKIM d=example.com signature, DMARC can still pass through that aligned signature.
The reverse also occurs. A message can carry a valid DKIM signature from d=vendor.example while showing From: example.com. That is a DKIM pass but not an aligned DKIM pass. DMARC needs aligned SPF OR aligned DKIM; it does not require both. This is why a message's authentication summary needs domain context rather than a simple pass/fail count.
Third-party senders often expose these gaps. A ticketing platform may use its own return path and sign with its own domain until configured with a custom aligned signing domain. Forwarding can break SPF because the forwarder IP is not authorized, but an aligned DKIM signature can preserve DMARC. Identify each sending path before deciding which authentication method to fix.
Subdomains and strict settings can introduce surprises. Relaxed alignment can allow a related organizational domain, whereas aspf=s or adkim=s requires an exact match. A policy at _dmarc.example.com, an sp setting, and a separate record at _dmarc.news.example.com can all influence the outcome. Check the visible From domain actually used by the sending system.
The checker verifies the policy record at the normal _dmarc name and reports missing, multiple, malformed, or available records. It does not perform live DKIM validation or inspect a delivered message. DMARC failure also is not identical to delivery failure: a receiving service may deliver, quarantine, or reject based on its own policy and other signals.
Alignment is the usual surprise
Mail can pass SPF for a provider's bounce domain while showing From: example.com. That does not satisfy DMARC through SPF unless those domains align. DKIM has the same concept: a valid signature from an unrelated d= domain may pass DKIM but not DMARC.
Strict adkim or aspf settings require an exact match and can expose sending paths that worked under relaxed alignment. Third-party platforms, forwarding, subdomains, and a visible From mismatch are common sources of failures.
Troubleshoot the published policy and senders
Confirm a single record exists at _dmarc.example.com and that p is valid. Multiple records and malformed tags are configuration problems. Check sp when subdomain mail is involved, then identify the actual envelope and DKIM domains used by every sender through mail-provider evidence.
DMARC failure is not the same as delivery failure. A receiver may still deliver, quarantine, or reject based on policy and reputation. Our checker reads policy DNS only; it does not validate a live DKIM signature, send a message, or contact reporting addresses.
Practical guidance
- Compare visible From with the SPF envelope and DKIM d= domains.
- Check relaxed versus strict alignment settings.
- Verify one valid DMARC record at the _dmarc name.
Common question
Can SPF pass and DMARC fail? Yes, when the passing SPF domain is not aligned with visible From.