Why Does DMARC Fail When SPF and DKIM Pass?

What DMARC actually checks

RFC 7489 adds one condition on top of SPF and DKIM: alignment. A message passes DMARC when at least one of these is true:

• SPF passes and aligns. The envelope sender (Return-Path, smtp.mailfrom) domain passed SPF and belongs to the same organizational domain as the From address.

• DKIM passes and aligns. A valid DKIM signature has a d= domain in the same organizational domain as the From address.

Relaxed alignment, the default, accepts subdomains: d=mail.yourdomain.com aligns with From: you@yourdomain.com. Strict alignment (adkim=s, aspf=s) needs an exact match.

That is why "SPF pass, DKIM pass, DMARC fail" is common. Both checks passed, for somebody else's domain.

Causes we see in cold email setups

The email header analyzer shows each check with its domain and whether it aligns with From.

What a fail does

The policy in your DMARC record decides:

• p=none: the receiver delivers by its usual rules and sends you reports. A fail still counts against you: Gmail requires bulk senders to pass DMARC alignment and rate-limits or blocks unaligned mail (codes 4.7.32 and 5.7.32).

• p=quarantine: failing mail goes to spam.

• p=reject: failing mail bounces. Gmail answers 550 5.7.26 "Unauthenticated email ... is not accepted due to domain's DMARC policy"; Microsoft answers 5.7.509 "does not pass DMARC verification and has a DMARC policy of reject."

A missing DMARC record is its own bounce at Gmail for bulk senders: 421 or 550 5.7.40, "the sending domain doesn't have a DMARC record". The DMARC record generator writes one.

How to fix it

1. Send a test to a Gmail or Outlook address you control and read the Authentication-Results header.

2. Find the domain that passed SPF and the d= that passed DKIM. If neither is yours, that is the failure.

3. Make DKIM align. One aligned DKIM pass is enough for DMARC and it survives forwarding, so this is the fix to do first.

4. Check the records with the DMARC checker and the SPF, DKIM and DMARC checker.

5. Read the aggregate reports (the rua= address) for a week: they list every source sending as your domain and whether it aligned.

What we recommend at Outreach2day

The domains we set up get a DMARC record with p=quarantine and reports, and every mailbox signs DKIM with the customer's own domain, so DMARC aligns from the first email. If you set up a domain yourself, start with p=none and reports, which meets Gmail's and Yahoo's bulk sender rules, and move to quarantine once the reports show every sender aligned.