DMARC failures happen when SPF or DKIM alignment does not match the visible From domain, especially when multiple platforms send on behalf of the same domain.
Common symptoms
- Legitimate mail is quarantined or rejected
- Only messages from one platform fail
- DMARC reports show alignment failures
Troubleshooting steps
- Audit every system that sends mail using the domain, including ticketing systems, contact forms, and marketing tools.
- Confirm each sender aligns with the visible From domain through SPF, DKIM, or both.
- If you are still onboarding senders, use a monitoring policy such as
p=nonetemporarily instead of strict rejection. - Avoid changing DMARC to reject until all sending systems pass alignment consistently.
- Review DMARC aggregate reports regularly to identify unknown senders.
Additional notes
- DMARC evaluates domain alignment, not just whether a message was signed or authorized somewhere.
- Third-party forwarders can complicate SPF results, making DKIM even more important.
When to contact support
Contact support if you need help identifying which sender is failing alignment.