Where you saw it: An aggregate report showing disposition quarantine or reject, a bounce message naming DMARC, or Authentication-Results reading dmarc=fail.
Why it happens
- SPF passes for the envelope sender but that domain differs from the From header, so it does not align.
- DKIM is not configured on the platform doing the sending, so there is no second chance when SPF alignment fails.
- A forwarding hop broke SPF, which is what forwarding does, and no DKIM signature was there to carry the result.
- Your policy is set to strict alignment, where a subdomain no longer counts as a match for the organizational domain.
- Someone is genuinely spoofing your domain, which is the case DMARC exists to catch and the one people forget to consider.
The fix, in order
Read the aggregate reports before changing anything
The XML names every source sending as your domain, with SPF and DKIM results and alignment for each. Guessing without that data is how legitimate mail gets blocked.
Sort the failing sources into legitimate and not
Your marketing platform failing is a configuration problem. An IP range in a country you do not operate in is the attack DMARC was built to stop, and it needs no fix on your side.
Fix alignment on each legitimate source
Either set a custom return path so the envelope domain matches your From domain, or enable DKIM signing with your own domain in the d= field. Either one satisfies DMARC.
Enable DKIM everywhere, even where SPF works
DKIM survives forwarding and SPF does not. A source with both passing is far more resilient than one relying on SPF alone.
Tighten policy in stages
Move from p=none to p=quarantine with a small percentage, watch the reports, raise the percentage, then move to reject. Skipping the middle costs you real mail.
v=DMARC1; p=none; rua=mailto:dmarc@example.com; pct=100Start here. Read reports for two weeks before touching the policy.
How to know it worked
The short version
- Aggregate reports show every legitimate source passing with alignment for a full week.
- A test message reads dmarc=pass in Authentication-Results.
- The disposition column shows none for your own traffic even after you raise the policy.
Questions people ask
Why does DMARC fail when SPF passes?
Because DMARC requires alignment as well as a pass. If the envelope sender is a platform domain and your From header is your own domain, SPF passes for them and aligns with nothing. Alignment is the part people miss.
Should I go straight to p=reject?
No. Run p=none until your reports show every legitimate source passing. Reject is the destination, not the starting position.
Does DMARC stop people spoofing my brand?
It stops them using your exact domain in the From header at receivers that honor the policy. It does nothing about lookalike domains, which is how most brand impersonation actually works.