How to Fix DMARC Fail

TL;DR: dmarc=fail in your email headers means neither SPF nor DKIM passed and aligned with your visible From domain. The five causes are: no SPF record, no DKIM signature, alignment mismatch between your From domain and your SPF/DKIM domain, SPF PermError (too many lookups), and email forwarding breaking the authentication chain. Scan your domain free at Kalenfy to see exactly which one is failing, then follow the fix below.

What dmarc=fail actually means

DMARC passes only when at least one of the following is true: SPF passes and the SPF domain aligns with the From domain, OR DKIM passes and the DKIM signing domain aligns with the From domain. If neither condition is met, the result is dmarc=fail.

What happens next depends on your DMARC policy (p=): with p=none the message still delivers but the failure is logged; with p=quarantine it goes to spam; with p=reject it's bounced outright. p=none is the most common setting and is why many domains send spoofable mail without knowing it.

The 5 causes of DMARC fail (and how to diagnose yours)

Fix 1: Add a missing SPF record

If your domain has no SPF record, any mail server can send email claiming to be from you. Add a TXT record to your DNS with the sending sources you use. A minimal example for Google Workspace:

v=spf1 include:_spf.google.com ~all

Add one include: for each service you send from (CRM, newsletter tool, etc.), then end with ~all (softfail) or -all (hardfail). Don't exceed 10 DNS lookups — see the SPF lookup limit guide if you have many senders.

Fix 2: Enable DKIM signing

DKIM requires your email provider to sign outgoing mail and you to publish a public key in DNS. In Google Workspace go to Admin console → Apps → Gmail → Authenticate email and click Generate new record; in Microsoft 365 go to Security → Email & collaboration → Policies → DKIM. After enabling, a record like this appears in your DNS:

selector1._domainkey.yourdomain.com  TXT  "v=DKIM1; k=rsa; p=MIGfM..."

Once the key propagates, outgoing mail will carry a DKIM-Signature and DKIM=pass appears in Authentication-Results.

Fix 3: Correct an alignment mismatch

This is the most commonly misunderstood cause. DMARC checks that the domain in SPF or DKIM matches the domain in the visible From header. If you send via a third-party platform and SPF passes on their domain but not yours, DMARC still fails.

• SPF alignment fix: configure your sending platform to use your own domain as the Return-Path (envelope sender). Most ESPs support "custom return path" or "custom bounce domain" settings.
• DKIM alignment fix: ensure the d= tag in the DKIM signature matches your From domain exactly. Most ESPs support "custom DKIM domain" — you add a CNAME record they provide, and outgoing mail signs under your domain.

Not sure which applies? Run a free Kalenfy scan — the report shows you exactly which domain each mechanism is authenticating against.

Fix 4: Resolve SPF PermError

If your SPF record has more than 10 DNS lookups, receivers return spf=permerror which counts as a fail. Remove unused include: entries, replace some with hard-coded ip4:/ip6: ranges, or flatten the record. Full walkthrough in the SPF too many lookups fix guide.

Fix 5: Handle forwarding

Email forwarding (e.g. a university address forwarding to Gmail) breaks SPF because the forwarding server isn't in your SPF record. The fix isn't in your DNS — it's structural. Options:

• Enable ARC (Authenticated Received Chain) on the forwarding server if you control it — this preserves the original auth results through the forwarding hop.
• Use SRS (Sender Rewriting Scheme) on the forwarder to rewrite the envelope sender so SPF passes at the destination.
• If DKIM is intact through the forward, ensure DKIM alignment is set to relaxed (adkim=r in your DMARC record, which is the default) so a subdomain signing key still counts.

How to verify the fix

After editing DNS, wait for propagation (typically 15 minutes to 2 hours). Then send a test message to a Gmail address and view the raw headers: look for dmarc=pass in Authentication-Results. Alternatively, re-scan your domain at Kalenfy — the scanner checks your live SPF, DKIM and DMARC configuration and shows you the updated grade.

FAQ

Does dmarc=fail mean my email was rejected?

Only if your DMARC policy is p=reject. With p=none (the default for new setups), mail still delivers but the failure is logged in aggregate reports. With p=quarantine, mail goes to the spam folder. Fix the underlying SPF/DKIM issue regardless of policy — the goal is to reach p=reject safely.

My SPF and DKIM both pass but DMARC still fails. Why?

This is an alignment problem. Both SPF and DKIM passed authentication, but neither passed against your visible From domain. Check that your Return-Path domain matches your From domain (SPF alignment) and that the DKIM d= tag matches your From domain (DKIM alignment).

How long does it take for a DMARC fix to take effect?

DNS changes propagate in 15 minutes to 48 hours depending on your registrar's TTL setting. Most modern registrars (Cloudflare, GoDaddy, Namecheap) push changes live in under 30 minutes. Use a fresh scan or send a test email after waiting to confirm.

Do I need a DMARC record to fix dmarc=fail?

If you have no DMARC record at all, receivers can't apply a policy — but some strict providers still flag the absence. Fix SPF and DKIM first, then add a DMARC record starting at p=none with an rua= address to receive aggregate reports, and move to p=reject once you've confirmed all legitimate mail passes.