"DMARC fail" means a message didn't pass SPF or DKIM for a domain matching its visible From address. Both checks can pass and DMARC still fails if neither lines up with your From domain. The fix is usually making every service that sends as you authenticate with your own domain, most often by enabling custom DKIM signing.
The rest of this post shows how to confirm a DMARC failure, the five common causes, step-by-step fixes, and when a failure is actually DMARC doing its job.
Key takeaways
- DMARC fail means neither SPF nor DKIM passed for a domain that aligns with the visible From address.
- SPF and DKIM can both pass while DMARC fails, often because a sending platform authenticates with its own domain instead of yours.
- The most effective fix is turning on custom DKIM signing with your domain for every service that sends as you.
- Do not relax your DMARC policy to stop failures, because that lets spoofed mail through without making legitimate mail pass.
What does DMARC actually check?
DMARC (now defined in RFC 9989, published in May 2026, which replaced RFC 7489) builds on two older checks:
- SPF checks that the sending server is allowed to send for the domain in the hidden envelope sender (the Return-Path).
- DKIM checks a cryptographic signature added by the sender, which names a signing domain (
d=).
DMARC passes when at least one of those passes and its domain aligns with the domain in the From: header people see. By default alignment is relaxed, so mail.example.com aligns with example.com because they share the same organisational domain. With strict alignment (aspf=s or adkim=s) the domains must be identical.
That's why "SPF pass, DKIM pass, DMARC fail" is common: your newsletter platform might pass SPF for its own bounce domain and sign DKIM with its own domain, neither of which is yours.
How do I know if an email failed DMARC?
- Check the headers. In Gmail, open the message, click the three dots and choose Show original. Google shows SPF, DKIM and DMARC results at the top. In Outlook, view the message source and find
Authentication-Results. - Read the Authentication-Results line. It looks something like this:
Authentication-Results: mx.google.com;
dkim=pass header.i=@sendingplatform.net;
spf=pass smtp.mailfrom=bounces.sendingplatform.net;
dmarc=fail (p=QUARANTINE sp=QUARANTINE dis=QUARANTINE) header.from=example.com
Here both SPF and DKIM passed, but for sendingplatform.net, not example.com, so DMARC failed and the message was quarantined.
- Read bounces. Gmail returns
550 5.7.26when mail is unauthenticated or fails the domain's DMARC policy. Microsoft uses550 5.7.509 Access denied, sending domain ... does not pass DMARC verification and has a DMARC policy of reject. - Read your DMARC aggregate reports. These daily XML reports from receivers list every source sending as your domain and whether it passed. Our guide on how to read DMARC reports walks through them.
Why does DMARC fail?
| Cause | What you'll see | Fix |
|---|---|---|
| Third-party service not set up | SPF/DKIM pass for the provider's domain, not yours | Enable custom DKIM and, ideally, a custom Return-Path on that service |
| DKIM not turned on in Google Workspace or Microsoft 365 | dkim=none, or a signature from a domain that isn't yours |
Generate and publish your DKIM key, then enable signing |
| SPF missing a sender, or over 10 DNS lookups | spf=fail, softfail or permerror |
Add the sender's include; flatten or trim the record |
| Forwarding or mailing lists | Mail passed at the original receiver, failed after forwarding | Rely on DKIM (survives plain forwarding); lists can use ARC or rewrite From |
| Spoofing | Unknown IPs sending as your domain | Nothing to fix: that's DMARC working |
How do I fix a DMARC failure?
- List every service that sends as your domain. Mailbox (Google Workspace or Microsoft 365), newsletter platform, CRM, helpdesk, invoicing and accounting software, website contact forms, booking systems. Your DMARC reports will reveal ones you forgot.
- Turn on DKIM with your domain on each one. Most platforms give you two or three CNAME or TXT records to add. This is the single most effective fix because DKIM alignment survives forwarding better than SPF.
- Set a custom Return-Path (bounce domain) where offered. This gives you SPF alignment too, using a subdomain such as
bounce.example.com. - Keep one valid SPF record. Only one
v=spf1record is allowed per domain, and it must stay within 10 DNS lookups. Check it with the free SPF checker, and see our guide to SPF too many DNS lookups if you're over. - Fix website contact forms. Forms that send "from" the visitor's address will always fail DMARC for that visitor's domain. Send from your own address via authenticated SMTP and put the visitor in Reply-To.
- Retest. Send a test to a Gmail account and check Show original for
dmarc=pass. MakeItFlow's free DMARC checker and DKIM checker confirm your records are published correctly.
Should I change my DMARC policy to stop failures?
No. Your policy (p=none, p=quarantine or p=reject) only tells receivers what to do with mail that fails. Relaxing it doesn't make legitimate mail pass; it just lets spoofed mail through too.
The right order is: publish p=none with a reporting address, fix every legitimate source until reports show them passing, then move to quarantine and finally reject. RFC 9989 removed the old pct tag for partial rollout and added a t=y test flag, though many receivers will take time to adopt the new tags. Our DMARC explainer covers the rollout in full.
MakeItFlow checks that your DMARC record exists and is valid as part of a full scan. Run a free website audit to see DMARC, SPF and DKIM results alongside the rest of your domain.
When is DMARC failure a good thing?
When the mail wasn't yours. If your reports show unknown IPs in other countries sending as your domain and failing, DMARC is identifying spoofing. At p=reject, receivers that honour your policy will refuse that mail. Our email authentication checklist covers getting there safely.
Frequently asked questions
What's the difference between DMARC fail and DMARC quarantine?
"Fail" is the result of the check. "Quarantine" is the action you asked receivers to take when mail fails, usually delivering it to spam. A message can fail DMARC and still be delivered if your policy is p=none.
Can DMARC fail if SPF and DKIM both pass?
Yes. DMARC needs at least one of them to pass for a domain aligned with your From address. If both pass for your email platform's domain instead of yours, DMARC fails.
Why does DMARC fail on forwarded emails?
Forwarding sends the message from a new server, so SPF fails. If the forwarder doesn't alter the message, the DKIM signature survives and DMARC still passes. Mailing lists that add footers or change subjects break DKIM, which is why some rewrite the From address or add ARC headers.
Does Gmail reject mail that fails DMARC?
Gmail generally applies the sending domain's policy. If the domain publishes p=reject, failing mail is rejected with 550 5.7.26; with p=quarantine it usually goes to spam. Bulk senders without DMARC at all face rejection too.
How long after fixing DNS will DMARC start passing?
Usually within minutes to a few hours, depending on the TTL of your records. Aggregate reports arrive daily, so allow two or three days before judging whether every source is now passing.
What to do next
Open a recent email from each tool your business uses, check Show original in Gmail and note any that show dmarc=fail. Turn on custom DKIM for those services first, then keep watching your aggregate reports. Once every legitimate source passes for two to four weeks, move your policy towards p=reject.
Related reading
- Email Bounce Codes Explained: 550, 5.7.x and 4xx Soft Bounces: Email bounce codes explained: what 550, 5.1.1, 5.7.x and 4xx soft bounces mean, which are your fault, and how to fix each one. With Gmail and Microsoft codes.
- How to Use Google Postmaster Tools (2026 Guide): How to use Google Postmaster Tools: verify your domain, read the compliance, spam rate and delivery error dashboards, and act on what they show in 2026.
- Why Do My Emails Go to the Gmail Promotions Tab?: Emails landing in Gmail's Promotions tab? Learn why Gmail sorts mail this way, why it isn't spam, and practical steps to reach Primary more often.
Sources
Written by the MakeItFlow team
We build the website audit these guides are based on. Every fact is checked against the primary sources listed above and this guide was last reviewed on 25 October 2026 . How we research and check
Check your own site in 30 seconds
Run a free audit covering speed, SEO, DNS, email authentication and security headers — and get a prioritised fix list.
