Why Your Emails Hit Spam: Troubleshooting DMARC Failures

Your emails land in spam because DMARC says they should. DMARC builds on SPF and DKIM. When an email fails DMARC, the receiving server applies the policy you set: none, quarantine, or reject. A quarantine policy sends emails to spam. A reject policy blocks them outright. If you see your campaigns in the spam folder, DMARC is the likely culprit.

How DMARC authentication works

DMARC (Domain-based Message Authentication, Reporting & Conformance) adds a policy on top of SPF and DKIM. It answers: What happens if both SPF and DKIM fail? The receiver checks two things:

• SPF alignment: The domain in the Return-Path (envelope from) must match the domain in the From header. Or be a subdomain of it.
• DKIM alignment: The domain in the d= tag of the DKIM signature must match the From domain.

If either check passes alignment, DMARC passes. If both fail alignment, DMARC fails. Then the DMARC policy kicks in.

Three DMARC policies and their impact

p=none

This policy tells receivers to take no action. Emails still deliver even if DMARC fails. Use p=none only to monitor traffic via aggregate reports. Do not rely on it for protection.

p=quarantine

If DMARC fails, the receiver treats the email as suspicious. Gmail sends it to spam. Outlook may mark it as junk. This is the most common reason your emails hit spam when testing a new domain.

p=reject

The receiver rejects the email outright. It never reaches the inbox or spam folder. This is the strictest policy and offers the best protection against spoofing, but only after you confirm all legitimate sources pass DMARC.

Diagnosing DMARC failures step by step

1. Check your DMARC DNS record. Use a DNS lookup tool. Verify it exists. A common mistake is forgetting to publish one at all.
2. Review aggregate DMARC reports. Services like Postmark or MXToolbox parse these. Look for failures from your own sending IPs.
3. Test SPF alignment. Take the domain from the Return-Path. Does it match your From domain? If not, you fail SPF alignment.
4. Test DKIM alignment. Examine the DKIM signature header. The d= domain must match or be a subdomain of the From domain. Many email services use a shared DKIM domain, so you must switch to a custom DKIM selector.
5. Check for third-party services. If you send transactional emails via SendGrid or SES, ensure their SPF include mechanism covers their IPs and that DKIM signatures use your domain, not theirs.
6. Update your DMARC policy gradually. Start with p=none, analyze failures, fix alignment issues, then move to p=quarantine and finally p=reject.

Common alignment issues and fixes

Issue	Why it fails DMARC	Fix
SPF uses a different domain	The Return-Path domain is separate from the From domain.	Request your ESP to use a subdomain of your From domain in the envelope.
DKIM signs with a shared domain	The d= tag contains myesp.com instead of yourdomain.com.	Generate a custom DKIM selector. Most ESPs provide this in their settings.
Third party not in SPF	Your SPF record doesn’t include the third party’s sending IPs.	Add an include: statement for the third party’s SPF record.
Missing DKIM signature	No DKIM signature at all. DMARC cannot check alignment.	Enable DKIM signing for your domain and publish the public key as a DNS TXT record.

Using DMARC reports to find unauthorized senders

DMARC aggregate reports (RUA) show every source that sends email from your domain. You receive these via email in XML format. Look for IPs you don’t recognize. If a spammer spoofs your domain, the report records their IP. This helps you identify phishing attempts targeting your brand. If you see legitimate services failing DMARC, add them to your SPF record or configure DKIM correctly.

When to escalate from none to quarantine to reject

Start with p=none for at least a week. Monitor reports. Once you confirm all legitimate email passes DMARC, switch to p=quarantine. Run that for another week. Check for false positives. If no issues arise, set p=reject. A common mistake is p=reject too early. That blocks newsletters, password resets, and order confirmations. Gradual escalation prevents disruption.

Testing DMARC before sending to real lists

Use email testing services that simulate DMARC validation. Send test emails to accounts at Gmail, Outlook, and Yahoo. Check headers for authentication results. Look for dmarc=pass or dmarc=fail. If you see fail, inspect the spf= and dkim= lines to understand why. Adjust until all test inboxes show pass.

What to do when a third-party service breaks DMARC

Third-party sending services often use their own domains in the Return-Path or DKIM signature. This breaks SPF or DKIM alignment. To fix it, configure a subdomain for each service. For example, use mail.yourdomain.com for your primary ESP and trans.yourdomain.com for transactional emails. Then set up separate SPF and DKIM records for each subdomain. This keeps alignment intact because the subdomain matches your main domain in the From header. Alternatively, ask your ESP if they support custom DKIM selectors or dedicated IPs with your domain in the envelope.

How to parse DMARC failure reports (RUF)

DMARC failure reports (RUF) are forensic reports that detail individual authentication failures. They are sent by receivers when DMARC fails and a policy of quarantine or reject is applied. Unlike aggregate reports, they contain the full email headers and sometimes the body. Use them to diagnose specific failures. However, they generate high volume. Enable them only temporarily. Set a small percentage, like 1%, in your DMARC record using the ruf tag. Parse them with a tool or script. Look for patterns like missing DKIM signatures or mismatched domains.

DMARC failures are fixable. Check alignment. Adjust your records. Move from p=none to p=reject slowly. Monitor reports. Your emails will stop hitting spam.

Frequently asked questions

What does a DMARC failure mean?

A DMARC failure means that both SPF alignment and DKIM alignment failed for an email. The email did not pass authentication checks, so the receiving server then applies the DMARC policy. If the policy is p=quarantine, the email goes to spam. If p=reject, it is blocked entirely.

How do I know if my DMARC is failing?

You can check DMARC failure by looking at email headers. Search for Authentication-Results. Look for dmarc=fail. You can also use a free DMARC analyzer tool that parses aggregate reports and shows you failure rates per source IP.

Can I have DMARC fail but still pass SPF?

Yes. SPF can pass if the sending IP is authorized, but DMARC also checks alignment. If the domain in the Return-Path does not match the From domain, SPF alignment fails. If DKIM alignment also fails, DMARC fails even though SPF passed technically.

What is the best DMARC policy for deliverability?

The best policy for deliverability is p=none because it never causes emails to be rejected or quarantined. However, it offers no protection. For both security and deliverability, p=quarantine is a good middle ground. It sends only unauthenticated email to spam, not to the trash.

Why does DKIM alignment fail with third-party senders?

DKIM alignment fails when the d= domain in the signature header does not match the From domain. Many third-party email services sign emails with their own domain. To fix this, configure a custom DKIM selector in the service so that it signs with your domain.