DMARC fails: SPF and DKIM do not match your domain

What it means

DMARC does not just ask "did SPF or DKIM pass?". It asks "did they pass for the same domain as the one in the From address?". That match is called alignment.

• SPF checks the hidden envelope sender (Return-Path). Newsletter and CRM tools often use their own domain there, such as bounces.newsletter-example.com.
• DKIM checks the domain in the signature (d=). If you did not set up DKIM for your own domain in the tool, it signs with its own domain.

So SPF and DKIM can both pass, for the provider's domain, while DMARC fails for yours.

Why it matters

A DMARC failure is what receivers act on. With p=quarantine your email goes to spam; with p=reject it is refused. Even with p=none, Gmail and Yahoo expect bulk senders to pass DMARC.

How to check

Delivmail checks this for you in two ways:

• Send a test email: on the home page, copy your unique test address, send it a normal email from the mailbox you want to check, then open the report. Look at the SPF, DKIM and DMARC lines together: they show which domain each check used, and whether the DKIM signature comes from your domain or from your provider.
• Use the Domain scanner: type your domain at /domain-scanner to read your DNS records without sending anything.

How to fix it

You only need one aligned check to pass DMARC. DKIM is the best choice because it also survives forwarding.

Option 1: set up DKIM for your own domain (recommended)

1. In the sending tool, find "domain authentication" or "DKIM".
2. Add the records it gives you to your DNS (usually TXT or CNAME under ._domainkey).
3. Confirm in the tool. Signatures will then use d=yourdomain.com.

Option 2: use a custom Return-Path

Many email services let you use a subdomain of yours as the envelope sender, often called "custom return path" or "custom bounce domain". You add a CNAME such as:

bounces.yourdomain.com  CNAME  (value given by your email service)

SPF is then checked on your subdomain, which aligns with your domain.

Option 3: your own server

If the email comes from your own server, make sure the envelope sender uses your domain and that the server IP is in your SPF record, and sign with DKIM for your domain.

Strict and relaxed alignment

By default DMARC uses relaxed alignment: mail.yourdomain.com matches yourdomain.com. If your record contains adkim=s or aspf=s (strict), the domains must match exactly. Unless you have a good reason, remove those tags:

v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.com

Forwarding and mailing lists

When an email is forwarded, SPF breaks because the forwarding server is not in your list. Mailing lists that change the content break DKIM too. You cannot fully fix this on your side, which is why aligned DKIM is so important.

Check that it is fixed

Send a new test email from the home page, from each tool you use. The DMARC line should pass. With Delivmail DMARC monitoring in the paid dashboard, you can also follow the daily reports and see every source that still fails.