Reviewed by: QuickDMARC Security Team · Email Authentication Specialists ·

DMARC Failure

A DMARC failure means neither aligned SPF nor aligned DKIM passed for the message's From domain. Fix the failing authentication path—or stop unauthorized use of your domain.

Read Authentication-Results

Headers show spf=, dkim=, and dmarc= results. A common pattern is spf=pass with dmarc=fail when alignment is wrong.

Authentication-Results: mx.example.net;
       spf=pass smtp.mailfrom=bounces.esp.com;
       dkim=pass header.d=esp.com;
       dmarc=fail header.from=brand.com

Top root causes

Unauthorized marketing tools, expired DKIM keys, SPF over 10 lookups, subdomain From addresses without policy coverage, and ARC/forwarding edge cases.

Fix workflow

Identify source from reports → authorize or remove → verify SPF/DKIM → re-check alignment → confirm in subsequent RUA windows.

How QuickDMARC helps

QuickDMARC groups failures by source so IT teams fix systems, not individual messages.

Frequently asked questions

SPF and DKIM both pass—why DMARC fail?

Usually alignment: validated domains do not match the From domain.

Does failure mean the message was rejected?

Only if your policy is quarantine/reject and the receiver enforces it.

Best tool to inspect one message?

Email header analyzer plus DMARC aggregate context.

Related resources