How to Fix DMARC Fail: Step-by-Step Guide (2026)

DMARC failures often result from misaligned domains or underlying SPF/DKIM issues. This guide walks you through diagnosing and fixing DMARC failures to secure your domain.

⚡ Analyze Now
Use the DMARC Report Analyzer to understand exactly which sources are failing and why.

Understanding DMARC Failure

DMARC failure occurs when a receiving mail server evaluates an email against your DMARC policy and determines it should fail. This happens when:

SPF or DKIM Fails: The underlying authentication checks don't pass.
Alignment Fails: The domain in the "From" header doesn't match the domain that passed SPF or DKIM.
Both SPF and DKIM Fail: Neither authentication method passes in alignment with your domain.

DMARC failures can be categorized into two types:

Pass (but DMARC fails): This means SPF or DKIM passed, but alignment failed. This is an alignment issue.
Fail (hard fail): Both SPF and DKIM failed. This is an authentication issue.

Step 1: Understand the Failure Type

Before you can fix DMARC, you need to know what's causing the failure. Check your DMARC reports (RUA). They contain detailed information about each sender:

Look at the "SPF" and "DKIM" columns: Do they show "pass" or "fail"?
Look at the "SPF Alignment" and "DKIM Alignment" columns: Do they show "pass" or "fail"?
If SPF or DKIM is failing: Fix those first using our SPF fix and DKIM fix guides.
If alignment is failing: Follow the steps below to fix alignment.

Step 2: Fix Underlying SPF/DKIM Issues

DMARC can't pass if SPF and DKIM are failing. Here's a quick checklist:

Is SPF set up correctly? Use the SPF Checker to verify.
Is DKIM set up correctly? Check with the DKIM Checker.
Do all legitimate senders pass? Use DMARC reports to identify which senders are failing.

Once SPF and DKIM are passing for all legitimate senders, DMARC failures will only be due to alignment issues.

Step 3: Relax Alignment

Alignment fails when the domain in the "From" header doesn't exactly match the domain that passed SPF or DKIM. There are two ways to fix this:

Use relaxed alignment (recommended): Set aspf=r (relaxed SPF alignment) and adkim=r (relaxed DKIM alignment) in your DMARC record. This allows subdomains to pass authentication for the parent domain.
Use strict alignment (more secure): Set aspf=s and adkim=s. This requires an exact match. Only use strict alignment if you never send from subdomains.

Example: A DMARC record with relaxed alignment: v=DMARC1; p=none; rua=mailto:[email protected]; aspf=r; adkim=r;

Step 4: Start with p=none

If you haven't already, start with p=none (monitor policy). This ensures your emails aren't blocked while you analyze reports and make adjustments.

Why p=none first?

It lets you see all sending sources without risking blocking legitimate email.
It gives you time to identify and fix alignment issues.
It allows you to gradually move to stricter policies with confidence.

Step 5: Analyze Reports and Update

Use our DMARC Report Analyzer to interpret your aggregate reports. Look for:

Which IPs are sending on your behalf? Are they legitimate?
Which IPs are failing? Are these unauthorized senders (malicious) or legitimate senders that need to be fixed?
What is the failure reason? SPF fail, DKIM fail, or alignment fail?

Once you've identified all legitimate senders and ensured they pass authentication, you can move to stricter policies.

Step 6: Progress to Quarantine, Then Reject

Move to stricter policies in stages:

p=quarantine: Set p=quarantine to send failures to spam. Monitor for 1-2 weeks. If no legitimate email ends up in spam, proceed.
p=reject: Set p=reject to block failures entirely. This is the ultimate protection against spoofing.

You can also use the pct tag to gradually apply the policy to a percentage of failing emails (e.g., pct=10 for 10% of failures).

Common DMARC Fix Mistakes

Moving to reject too quickly: This is the most common mistake. Always start with p=none and progress slowly.
Not setting up reporting: Without rua reports, you're flying blind. Always set up aggregate reports.
Ignoring subdomains: Remember to set sp= for subdomain policy if you send from subdomains.
Typos in the DMARC record: A missing semicolon or wrong tag name breaks everything. Always verify with our DMARC Checker.

Frequently Asked Questions

What's the difference between SPF/DKIM alignment and authentication?

Authentication is the SPF and DKIM checks themselves. Alignment is whether the domain in the "From" header matches the domain that passed authentication. Both are required for DMARC to pass.

How long should I stay on p=none before moving to quarantine?

At least 1-2 weeks. This gives you time to collect enough reports to identify all legitimate senders. Some organizations stay on p=none for months.

Can I use DMARC without SPF or DKIM?

No. DMARC requires at least one of them to pass in alignment. Setting up DMARC without SPF or DKIM will cause all your email to fail.

What if my DMARC reports show unauthorized senders?

Unauthorized senders may be legitimate services you forgot to add to your SPF or DKIM, or they could be malicious actors. Identify them through the IP and domain information in the reports and either add them to your authentication records or take action against them.

Conclusion

Fixing DMARC failure is a journey, not a one-step process. Start with p=none, analyze your reports, fix SPF and DKIM issues, ensure alignment, and progress to quarantine and reject. The key is patience—moving too quickly can block legitimate email.

Ready to fix your DMARC? Start by analyzing your reports with our DMARC Report Analyzer.