What happens when DMARC fails?

When a message fails DMARC, what happens next depends on your DMARC policy. The receiving server applies whatever you've specified in the p= tag of your DMARC record.

p=none: Nothing happens to message delivery. The message goes where it would have gone anyway. But the failure gets logged in your aggregate reports, which is the whole point of starting at none. You can see failures without affecting mail flow.

p=quarantine: The message is routed to spam or junk. Most inbox providers will honor this and route failing messages away from the inbox. It's not a guarantee of spam folder placement on every provider, but major ones (Gmail, Outlook, Yahoo) generally follow it.

p=reject: The receiving server refuses to accept the message entirely. It gets rejected at the SMTP level, before it's ever delivered. The sender gets a bounce back indicating the message was rejected due to DMARC policy.

What causes DMARC to fail? A message fails DMARC when neither SPF alignment nor DKIM alignment pass. Specifically: the SPF-authenticated domain doesn't match your "From" domain, AND the DKIM signing domain doesn't match either. It only takes one of them to align for DMARC to pass. Both failing is what triggers the policy.

Common causes of DMARC failures:

• Forwarded email where the forwarder's IP breaks SPF (DKIM usually survives forwarding)
• An ESP configured to sign with its own domain, not yours
• A sending service you forgot to authorize in your SPF or DKIM setup
• Your DKIM selector pointing to an expired or missing DNS record

If you're seeing unexpected DMARC failures, your aggregate reports will show you which sources are failing and why. Our free DMARC parser makes those reports readable. For persistent failures you can't diagnose from the reports, the SOS hotline is free.

For more on what alignment means and why it's the core mechanism here, see DMARC alignment modes. For the full policy options and what each level means, see DMARC policies.