A message fails DMARC when neither SPF nor DKIM both passes and aligns with the visible From domain. The two fixes are: make sure each legitimate sender has working SPF or DKIM, and make sure the authenticated domain aligns with your From domain. Alignment — not just a pass — is what trips most senders up.
DMARC requires alignment: the domain that SPF or DKIM validated must match your From domain. A marketing platform can pass SPF for its domain while your From domain is yours — SPF passes, DMARC fails. DKIM alignment (signing with your domain) is usually the more reliable path because it survives forwarding.
Your DMARC rua aggregate reports show, per source, whether SPF and DKIM passed and aligned. Work through each failing source: enable domain-aligned DKIM at the provider, or add them to SPF with a matching envelope domain. Don’t move to p=reject until the real senders show aligned passes.
Make sure you have an rua address collecting data:
$ dig TXT _dmarc.yourdomain.com +shortCheck your DMARC record now
Open the free DMARC checker →Because SPF authenticated a different domain than your From domain (no alignment). Enable DKIM signed with your own domain, or align the envelope/return-path domain.
Forwarding breaks SPF, but a valid DKIM signature survives forwarding — which is why DMARC needs DKIM to be reliable.
