In short
A DMARC fail means a message had neither an SPF pass nor a DKIM pass for a domain aligned with its From address. Your own failing mail usually comes from a third-party sender not yet set up, or forwarding. UK public sector bodies must enforce DMARC on inbound email, so failing mail sent to them may be held.
Get a quote for DMARC troubleshooting
Tell us roughly how many users or sites you have and we will come back to you with options and a quote.
What DMARC fail means
DMARC checks one thing: did this message authenticate for the domain in its visible From address? RFC 9989 section 5.3.5 (opens in a new tab) sets out the test. A message passes if at least one of these is true, and fails if neither is:
- SPF passed for the envelope sender (Return-Path) domain, and that domain aligns with the From domain
- DKIM (opens in a new tab) passed for a signature whose d= domain aligns with the From domain
Aligned means the same organisational domain (relaxed alignment, the default) or exactly the same name (strict, if you set aspf=s or adkim=s). So a message can pass SPF and DKIM and still fail DMARC, if both passed for someone else's domain, such as your email marketing platform's.
A DMARC failure is the result for one message. Your DMARC policy is what you have asked receivers to do with failures. With p=none, failing mail is still delivered and simply appears in your reports; with quarantine or reject, receivers that honour your policy send it to spam or refuse it. See DMARC policy for the options.
Receivers record the result in the Authentication-Results header (RFC 8601 (opens in a new tab)), using the result names registered in RFC 9989 section 9.2 (opens in a new tab):
| Result | Meaning |
|---|---|
| dmarc=pass | A DMARC record exists and an aligned SPF or DKIM pass was found |
| dmarc=fail | A DMARC record exists but no aligned pass was found |
| dmarc=none | The From domain has no DMARC record |
| dmarc=temperror | A temporary error, such as a DNS server not answering; a later attempt may succeed |
| dmarc=permerror | A permanent error, such as a badly formatted DMARC record |
Not sure which option fits? Ask us
Tell us what you need and we will recommend the right option for your organisation, with a quote.
Reading the bounce or warning
The same failure is worded differently depending on who reports it. These are the versions you are most likely to meet:
| Where you see it | Typical wording | What it tells you |
|---|---|---|
| Gmail bounce (Google's error list (opens in a new tab)) | 550 5.7.26 Unauthenticated email from domain-name is not accepted due to domain's DMARC policy | Gmail did not accept the message because it failed DMARC under the domain's published policy |
| Outlook.com bounce (Microsoft support (opens in a new tab)) | 550 5.7.515 Access denied, sending domain does not meet the required authentication level | A high-volume sender to Outlook.com, Hotmail or Live.com has not met Microsoft's SPF, DKIM and DMARC requirements |
| Email security gateway notice | DNS authentication: DMARC fail | The recipient's gateway checked the message, found no aligned pass and held or refused it |
| Message headers | Authentication-Results: ... dmarc=fail header.from=example.co.uk | The receiving server's own verdict, with the From domain it tested |
| Aggregate report (RFC 9990 (opens in a new tab)) | disposition quarantine or reject, with dkim fail and spf fail in policy_evaluated | How many messages from that source failed, and what the receiver did with them |
Gmail has other 5.7.26 messages, for unauthenticated mail and for SPF hard fails (-all). The DMARC one is the message that names the domain's DMARC policy. Microsoft's Outlook.com requirements (opens in a new tab) apply to domains sending more than 5,000 messages a day, and have rejected non-compliant mail with 5.7.515 since May 2025.
A full header line for a typical third-party sender failure looks like this, where both checks pass but for the platform's domain rather than yours:
Authentication-Results: mx.example.net; spf=pass smtp.mailfrom=bounce.mailer.example; dkim=pass header.d=mailer.example; dmarc=fail header.from=example.co.uk
The fix in that case is to make the platform sign with DKIM for your domain, or use a return-path on your domain.
Common causes of DMARC failures
Most failures of your own mail come from a short list of causes:
| Cause | What happens | Fix |
|---|---|---|
| Third-party sender not set up | A CRM, newsletter, helpdesk or invoicing platform sends as your domain but signs with its own DKIM domain and its own return-path | Set up the platform's custom DKIM for your domain (and a custom return-path if it offers one). See DMARC for email marketing |
| Forwarding | A forwarder relays the message from its own servers, so SPF fails; DKIM usually survives (RFC 9989 section 7.4 (opens in a new tab)) | Make sure all your mail is DKIM-signed, so it passes on DKIM after forwarding |
| Mailing lists | Lists often add a subject tag or footer, which invalidates the DKIM signature (RFC 7960 section 3.2.3 (opens in a new tab)) | Mailing list software has widely adopted From rewriting to keep posts aligned (RFC 9989 section 7.4); receivers may report list traffic with a mailing_list override reason |
| Domain not aligned | SPF passes for the envelope domain and DKIM passes for a signing domain, but neither matches the From domain | Align at least one: sign with d= your domain, or send with a return-path on your domain |
| SPF over 10 lookups | SPF returns permerror once more than 10 DNS-querying terms are used (RFC 7208 section 4.6.4 (opens in a new tab)), so SPF cannot pass | Remove unused includes, or use a managed SPF service |
| Wrong or missing DKIM selector | The selector in the DKIM-Signature (s=) has no public key in your DNS, or an old key | Publish the key the sending service gives you at selector._domainkey.yourdomain |
| Strict alignment set | aspf=s or adkim=s demands an exact match, so mail signed for a subdomain fails | Use relaxed alignment unless you have a reason not to |
| Genuine spoofing | Someone else is sending as your domain | Nothing to fix on your side: this is DMARC working. Enforce your policy so receivers act on it |
Our guide to SPF, DKIM and DMARC explained covers alignment in more detail, and the DMARC checker tests your SPF lookup count and DKIM selectors.
Is DMARC troubleshooting the right fit for you?
We will check it against your systems and requirements and recommend the right option.
Finding which source is failing
One bounce tells you about one message. To fix failures for good you need to see every source, and that is what aggregate reports are for. Each record in a report (RFC 9990 (opens in a new tab)) gives you:
- The sending IP address and how many messages came from it
- The From domain, and the envelope (Return-Path) domain SPF was checked against
- The DKIM signing domain and selector, with each result
- Whether SPF and DKIM were aligned, and the disposition the receiver applied
Grouping those records by sending service turns a list of IP addresses into a list of names: "Microsoft 365 passes, the CRM fails DKIM, an unknown server in another country fails both". The unknown server is likely spoofing; the CRM is a set-up job. Reading the XML by hand is slow, so a DMARC report analyser does the grouping for you. Our guide to DMARC reports explains every field.
A DMARC fail fix checklist
Work through this list for each failing source you recognise:
- Confirm the source is genuine: is it a service your organisation uses, and does someone own it?
- Look at the failing message's headers: which domain did SPF check, and which d= domain did DKIM sign with?
- Set up DKIM signing for your own domain in that service, and publish the selector record it gives you
- If the service supports a custom return-path or bounce domain on your domain, set it up so SPF aligns too
- Add the service to SPF only if it sends with a return-path on your domain, and keep the record under 10 lookups
- Send a test message to a mailbox you control and check the Authentication-Results header shows dmarc=pass
- Watch the next few days of aggregate reports to confirm the source now passes, then move on to the next one
For sources you do not recognise, check with the teams that buy software before assuming spoofing. Once only unknown sources are failing, you are ready to tighten your policy.
"No DMARC record found"
This message comes from DNS checkers, scanners and some receivers when there is nothing at _dmarc.yourdomain (or at the organisational domain, for a subdomain). In headers it appears as dmarc=none. It is not a failure as such: there is no policy to fail against. It does mean:
- Receivers have no instruction from you about mail that pretends to be from your domain
- Nobody is sending you reports, so you cannot see who sends as you
- High-volume senders fall short of mailbox provider rules: Google's email sender guidelines (opens in a new tab) require DMARC for anyone sending 5,000 or more messages a day to personal Gmail accounts
The fix is to publish a record at p=none with a rua address, for example v=DMARC1; p=none; rua=mailto:dmarc@example.co.uk. Our DMARC generator builds one for you, and how to set up DMARC walks through the full process.
Getting help with DMARC failures
When failures come from several platforms at once, or from services nobody remembers buying, it helps to have the reports already sorted by sender. We can:
- Assess your domains: review DMARC, SPF and DKIM on every domain and read the failure messages you are seeing
- Set up reporting: connect your domains to a platform that names each sending service and shows its failure reasons
- Choose and supply the platform: EasyDMARC, Valimail or the Check Point Email Security DMARC Management add-on, which Check Point says gives a summary of failure reasons and a recommendation (opens in a new tab) for each failing sending source
- Move you to enforcement: once genuine senders pass, help you plan the policy steps for each domain
Licences can be billed monthly, with terms confirmed at quote. See DMARC management or contact us for free advice.
Frequently asked questions
Is a DMARC fail always spoofing?
No. Many failures are your own mail from a service that has not been set up to authenticate as your domain, or genuine mail that was forwarded or sent through a mailing list. Spoofing usually shows up as sources you do not recognise, often failing both SPF and DKIM. Your aggregate reports let you tell the two apart.
Why does mail pass SPF but fail DMARC?
Because SPF passed for a different domain. SPF checks the envelope sender (Return-Path), which for many third-party platforms is the platform's own bounce domain. DMARC needs that domain to align with the From address. Set up DKIM for your domain in the platform, or a custom return-path on your domain, and the message will pass.
What does a DMARC fail look like in Authentication-Results headers?
Look for dmarc=fail followed by header.from= and your domain, for example: dmarc=fail header.from=example.co.uk. The same header shows the spf= result with smtp.mailfrom= and the dkim= result with header.d=. If those domains are not yours, that is the alignment problem to fix.
Can a message fail DMARC when my policy is p=none?
Yes. The DMARC result and the policy are separate. With p=none a failing message is still recorded as dmarc=fail and appears in your reports, but receivers are not asked to treat it differently. That is what makes p=none useful: you can find and fix failures before any mail is affected.
What does "5.7.26 domain's DMARC policy" mean?
It is Gmail's bounce for a message that failed DMARC, refused because of the sending domain's DMARC policy. Google's SMTP error list (opens in a new tab) words it as: Unauthenticated email from domain-name is not accepted due to domain's DMARC policy. If it is your domain and the mail was genuine, the sending service needs DKIM or SPF aligned with your domain.
Still have a question about DMARC troubleshooting?
Ask us and a member of our team will get back to you.