How to Fix DMARC Failure
Use receiver evidence to distinguish missing policy, authentication failure and alignment problems.
Login2Cloud product team · Published 2026-09-27
Collect one failing example
Start with the original message headers from a receiver you trust. Record its Authentication-Results, visible From domain, envelope sender and DKIM signing domain. Avoid sharing full message contents or recipient information publicly. A DNS tool result and a receiver result describe different parts of the process.
Check authentication and alignment
If SPF passes for a provider-owned bounce domain, it may still fail to align with your visible From domain. If DKIM passes for a provider domain, it may have the same alignment problem. Configure the provider’s supported custom signing or return-path settings and verify the actual identities used in a new message.
Inspect DNS at the right names
Look up SPF at the envelope sender domain and DMARC at the applicable author domain. For DKIM, read the selector from the signature and query that selector under _domainkey. Do not assume that every sender uses default or that one discovered selector represents every sending service.
Account for forwarding and modifications
Forwarding can affect SPF because the connecting sender changes. Message modifications can invalidate a DKIM signature. Investigate the delivery path and the receiving system’s treatment of that path. Do not broadly weaken your domain policy to accommodate an unexplained failure.
Retest each sending stream
After a correction, send fresh examples from account mail, marketing mail and transactional systems. Compare results and monitor aggregate reports over time. Tighten policy only when legitimate sources are understood. Login2Cloud email-domain checks watch published configuration; they do not replace message-level acceptance testing.
Common questions
Can changing p=reject to p=none fix authentication?
It changes requested handling, not the underlying authentication or alignment defect.
Where do I find a DKIM selector?
Read the s= value in a DKIM-Signature header or the sending provider’s documented DNS configuration.