Why Your DMARC Reports Show Failures
You published DMARC, reports started coming in, and now you're seeing failures. This is normal — and it's exactly the information you need. Here's how to read failures and what each type means.
What a failure actually means
A DMARC failure means a message claimed to be from your domain, but neither SPF nor DKIM aligned with your From: address. The failure could be legitimate mail that isn't configured correctly, or it could be an actual spoofing attempt. The report data helps you tell the difference.
Look at three things in each failure record: the sending IP, the volume, and whether SPF and DKIM passed (even if they didn't align).
Cause 1: Vendor not set up for alignment
This is the most common cause. A CRM, marketing platform, or billing tool sends email as your domain, but it signs with its own DKIM key and uses its own return-path. Both SPF and DKIM may pass technically — just not for your domain.
How to identify it: Look up the sending IP. It resolves to a known platform like Salesforce, Mailchimp, or HubSpot. The DKIM d= domain is the vendor's domain, not yours.
Fix: Configure custom DKIM domain signing at the vendor. Most platforms support this via a CNAME you publish in your DNS. The vendor signs mail with your domain's selector, so DKIM aligns. See Setting Up DKIM for Common ESPs.
Cause 2: Email forwarding
When someone forwards email from your domain, the forwarding server rewrites the envelope sender. SPF fails because the forwarding server isn't on your authorized list. DKIM usually survives forwarding, so DMARC can still pass on DKIM alone — but only if DKIM was set up correctly in the first place.
How to identify it: Failures from many different consumer IPs (Gmail, Yahoo, Outlook users), often at low volume per IP. The SPF result shows a fail or neutral for a domain that looks like a personal email provider or mail host.
Fix: Ensure DKIM is working and aligned. If DKIM alignment is solid, forwarding-related SPF failures won't cause DMARC to fail. There's nothing wrong with your configuration; forwarded mail will always have SPF failures.
Cause 3: Mailing list software
Mailing lists often rewrite the From: address or the envelope sender, breaking both SPF and DKIM alignment. Some lists add list headers or alter the message body, which also invalidates the DKIM signature.
How to identify it: Failures from a consistent IP that resolves to a mailing list host. DKIM may show as a fail (signature broken) rather than just an alignment mismatch.
Fix: This is a known incompatibility between mailing lists and DMARC. The recommended approach is to use a subdomain for list traffic, or accept that mailing list delivery from enforcing domains has limitations.
Cause 4: SPF lookup limit exceeded
If your SPF record has too many nested include: references, SPF evaluation exceeds 10 DNS lookups and returns a PermError. This counts as SPF fail. If DKIM isn't also aligned, DMARC fails.
How to identify it: SPF result shows permerror rather than pass or fail. Check your SPF record with an SPF validation tool and count the lookups. See Fixing the 10-Lookup Limit.
Fix: Consolidate SPF includes or flatten the record by replacing include: with resolved IPs.
Cause 5: Actual spoofing
Some failures are exactly what DMARC is designed to catch: someone sending email impersonating your domain. You don't recognize the sending IP, it doesn't resolve to any service you use, and there's no legitimate reason for it to be sending as your domain.
How to identify it: Unknown IP, no match to any known service, possibly resolving to residential or hosting infrastructure associated with spam. Both SPF and DKIM fail entirely — no technical pass of either.
Fix: Nothing to fix. This is the threat DMARC enforcement is designed to block. Once you reach p=quarantine or p=reject, these messages will be filtered or rejected.
Cause 6: A sender you forgot about
Legacy on-premises mail servers, old automation scripts, website notification plugins, monitoring tools — these send email infrequently and are easy to miss during the initial inventory.
How to identify it: An IP that resolves to your own infrastructure or a vendor you do actually use, sending low volume, failing alignment.
Fix: Either configure the sender for alignment, or stop it from sending as your domain if it no longer should be.