Mailing lists and Google Groups break DMARC

What it means

A discussion list (Google Groups, Mailman, a group address in Microsoft 365, many forum tools) receives your email and sends a copy to every member. On the way it often:

• sends it from its own servers, so your SPF no longer matches;
• changes the content: adds a tag like [club] to the subject or a footer with an unsubscribe link, which breaks your DKIM signature.

With both SPF and DKIM broken for your domain, DMARC fails. If your domain uses p=quarantine or p=reject, members may never get your message.

Why it matters

• Your posts to a list silently go to spam for some members.
• If many copies fail, the list may count bounces and even unsubscribe members automatically.
• Your DMARC reports show failures from servers you do not know, which can look like spoofing.

How lists solve it

Rewriting the From

Most modern list tools change the From header when the sender's domain has a strict DMARC policy:

From: Jane Smith via Club Members <club@lists.example.com>
Reply-To: jane@yourdomain.com

The email now comes from the list's domain, which passes its own DMARC. Replies still reach the sender. Google Groups does this automatically. In Mailman, look for the DMARC mitigation settings ("munge From" or "wrap message").

ARC

ARC (Authenticated Received Chain) lets the list add a sealed note saying "SPF and DKIM passed when I received this". Large receivers like Gmail and Microsoft can trust that note from well-known intermediaries. Google Groups adds ARC. It helps, but each receiver decides whether to trust it.

What to do

If you run a list

1. Turn on From rewriting for senders whose domains use p=quarantine or p=reject (or for everyone).
2. Avoid changing messages if you can: no subject tags or footers keeps DKIM intact.
3. Authenticate the list's own domain with SPF, DKIM and DMARC.
4. For Microsoft 365 receivers, an admin can add a list service to the trusted ARC sealers.

If you send to lists

• Make sure DKIM signs every email; with lists that do not modify messages, DKIM survives.
• Before moving to p=reject, check your DMARC reports for list servers and ask list owners to enable From rewriting.
• Delivmail DMARC monitoring, in the paid dashboard, helps you spot these sources in your reports.

Check that it is fixed

Send a test email directly from the Delivmail home page first: it should pass SPF, DKIM and DMARC, which proves your own setup is right. Then post to the list and ask a member at Gmail or Outlook whether the message arrived in the inbox, with the list's name in the From.