DMARC Errors and Fixes: Alignment, Reporting, Policy Issues

June 20, 2026 • InboxGreenEmail Team

DMARC is the protocol that ties SPF and DKIM together and tells receivers what to do when neither passes. When DMARC fails, the consequences range from spam folder placement to outright rejection. Most problems come from alignment issues, syntax mistakes, or misreading what DMARC reports are actually telling you.

Check your DMARC record first: use the DMARC Lookup tool to see what is published, or run the full InboxGreen.email check to see SPF, DKIM, and DMARC together.

1. DMARC fails even though SPF and DKIM both pass

This is the most common and most misunderstood DMARC problem. SPF passing and DKIM passing are not the same as DMARC passing. DMARC requires alignment.

Alignment means:

• SPF alignment: the domain in the envelope sender (the Return-Path: address) must match the From: domain
• DKIM alignment: the domain in the DKIM d= tag must match the From: domain

DMARC only requires one to align. If DKIM alignment passes, DMARC passes even if SPF alignment fails (and vice versa).

The typical scenario: you send through an ESP. SPF passes because the ESP's IP is covered by their own SPF record. DKIM passes because the ESP signs the message. But the ESP signed with d=mailgunapp.com, and your From: is [email protected]. DKIM passes, alignment fails.

From: hello@yourdomain.com
DKIM-Signature: d=mailgunapp.com; ...
Authentication-Results: mx.google.com;
  dkim=pass header.i=@mailgunapp.com;
  dmarc=fail (p=REJECT) header.from=yourdomain.com

From: hello@yourdomain.com
DKIM-Signature: d=yourdomain.com; ...
Authentication-Results: mx.google.com;
  dkim=pass header.i=@yourdomain.com;
  dmarc=pass (p=REJECT) header.from=yourdomain.com

Fix: Configure custom domain sending at your ESP so messages are signed with d=yourdomain.com. This is standard practice at every major ESP. See the Email Authentication Guides for provider-specific steps.

For email forwarding scenarios: SPF alignment breaks when a message is forwarded (the envelope sender changes). DKIM alignment survives forwarding as long as the body is not modified. If you have users who forward mail, DKIM alignment is what keeps DMARC passing for them.

2. No DMARC aggregate reports arriving

DMARC aggregate reports (rua=) should start arriving within 24 to 48 hours of publishing your DMARC record. If you are not receiving them, check these in order:

The rua= address is wrong or unreachable:

The address in rua=mailto:[email protected] must be a working mailbox. Test it by sending a message to that address manually.

Cross-domain reporting authorization is missing:

If your rua= address is at a different domain than the one you are monitoring (for example, monitoring yourdomain.com but sending reports to [email protected]), the reporting domain must publish a special TXT record authorizing this:

yourdomain.com._report._dmarc.reportingservice.com  IN TXT  "v=DMARC1"

Without this record, Gmail and others will refuse to send reports to third-party addresses.

Receiving volume is too low:

Major providers only send DMARC reports if they processed a meaningful volume of messages from your domain during the reporting period. New senders or domains with low volume may not get reports for several days.

Reports go to spam:

Check the spam folder on the rua= mailbox. DMARC reports arrive as XML attachments from [email protected], [email protected], and others.

3. DMARC PermError (syntax error in the record)

A DMARC record with a syntax error causes receivers to return PermError, which is treated as a missing DMARC record. The policy is not applied. Common syntax mistakes:

• Missing v=DMARC1 as the first tag
• Using the wrong separator: DMARC tags are separated by semicolons (;), not commas or spaces
• Invalid tag values: p=reject; is correct, p=REJECT; is also accepted, but p=rejected; is not
• Two DMARC TXT records on the same _dmarc subdomain (only one is allowed)
• Spaces inside tag values where they are not allowed

Check your syntax with the DMARC Lookup tool. It will show you the parsed tags if the record is valid, or an error if it is not.

4. Moving from p=none to p=quarantine to p=reject

The policy value in your DMARC record controls what happens to messages that fail alignment:

Moving too fast to p=reject is the most common self-inflicted DMARC problem. If any legitimate sending source is not properly authenticated, those messages start bouncing with no warning to recipients.

The safe progression:

1. Start at p=none with a rua= address. Wait at least two weeks. Review the aggregate reports to see which sources are sending on behalf of your domain and whether they pass alignment.
2. Fix alignment issues for every legitimate source. DKIM alignment at your ESP, SPF records for bulk senders, CNAME records for marketing tools. Do not move forward until aggregate reports show close to 100% alignment for all legitimate sources.
3. Move to p=quarantine with pct=10 first. Monitor for a week. Increase gradually.
4. Move to p=reject only when you are confident every legitimate sending source is aligned. Set pct=100 at this stage.

Google and Yahoo now require at least p=none for bulk senders. p=reject is the long-term goal for most domains.

5. DMARC passes but emails still go to spam

DMARC passing means your authentication is in order. It does not guarantee inbox placement. Spam filters use dozens of signals beyond authentication:

• Sender reputation: how Gmail and Outlook score your domain based on past complaints, bounce rates, and engagement
• IP reputation: shared IPs at ESPs inherit reputation from other senders on the same pool
• Engagement history: low open rates and high delete rates train filters to route you to spam
• List quality: sending to invalid addresses or unengaged contacts increases bounce rate and complaint rate
• Content signals: certain phrases, excessive images, broken HTML, and URL patterns increase spam scoring

Authentication (SPF, DKIM, DMARC) is the baseline. It prevents your domain from being spoofed and establishes accountability. Inbox placement on top of that comes from reputation and engagement.

Run the full deliverability check to see your complete authentication status, then work through the reputation and content signals from there.

DMARC Tools

Related Guides

Common Questions About DMARC