DMARC troubleshooting

What Does a DMARC Fail Mean?

A DMARC fail means the message did not establish a DMARC-aligned authentication path for the domain shown in the visible From address.

In practical terms, neither aligned SPF nor aligned DKIM satisfied DMARC for that message. The cause can be malicious spoofing, but it can also be a legitimate sender or forwarding path that is not configured or aligned as expected.

Run the free website security check

Common causes of DMARC failure

Third-party platforms are a frequent source of legitimate DMARC failures when they send on behalf of a business without the expected SPF authorisation, DKIM signature or domain alignment.

SPF passes for a different domain that does not align with the visible From domain.
A DKIM signature is missing, invalid or uses a signing domain that does not align.
Forwarding changes the delivery path and SPF no longer passes for the original sender.
A sending service was added without being included in the organisation's email-authentication design.
The message genuinely came from an unauthorised source impersonating the domain.

Start with the authentication results

Troubleshooting should identify which domain SPF authenticated, whether DKIM verified, which DKIM signing domain was used, and how those domains relate to the visible From address.

The key question is not simply whether SPF or DKIM passed somewhere in the message. DMARC needs at least one successful mechanism to be aligned with the visible From domain.

Forwarding and mailing systems

SPF can fail after forwarding because the forwarding server becomes the connecting sender. DKIM may continue to verify if the forwarded message preserves the signed content, which is one reason organisations often deploy both SPF and DKIM.

Do not fix a DMARC fail by weakening policy

A failure should be investigated before changing the domain's policy. Weakening authentication to make a legitimate-looking message pass can reduce protection for every other message. First identify whether the sender is authorised and which alignment path should legitimately succeed.

Check the live public DNS record

Use the matching ScoutLab checker with only a domain name. No signup or email address is required.

Free DMARC checkerLook up the live DMARC policy published in public DNS.

Check your public email-authentication signals

ThreatScout can externally observe public SPF, DKIM and DMARC records and policy signals as part of the free website security scan. It does not change your DNS or email configuration.

Run the free website security check

Keep reading

SPF, DKIM and DMARC explainedSee how the three email-authentication layers work together.

What is DMARC?Review how DMARC alignment works.

SPF record explainedUnderstand the SPF side of authentication.

What is DKIM?Understand DKIM signatures and selectors.

Frequently asked questions

Does a DMARC fail always mean the email is malicious?

No. A DMARC failure is a strong signal that the message did not authenticate in an aligned way, but legitimate mail can fail because of third-party sender configuration, forwarding or domain-alignment mistakes. The sending source still needs to be investigated.

Can SPF pass while DMARC fails?

Yes. SPF can pass for an envelope sender domain that does not align with the visible From domain. In that case SPF authentication succeeded, but it did not create an aligned SPF path for DMARC.

Can DKIM pass while DMARC fails?

Yes. DKIM can verify successfully for a signing domain that does not align with the visible From domain. DMARC evaluates alignment as well as the underlying authentication result.

Technical references

SPF, DKIM and DMARC are domain-level email-authentication controls. They reduce specific spoofing risks but do not replace mailbox security, phishing controls, account protection or broader cyber security measures.