DMARC fails on alignment while SPF and DKIM both pass
DMARC checks the From header against the envelope-from. If they don't align on the same domain, DMARC fails despite valid auth.
Try this first
- 1Check the Return-Path header in the source
- 2Compare it to the From address in the header
- 3Both must sit on the same organisational domain
- 4ESP settings: enable 'custom return path' so the envelope uses your domain too
When to bring us in
If your ESP can't do custom return path, switch ESPs, it blocks strict DMARC alignment.
See also
- Our emails land in spam for some recipientsAlmost always an SPF, DKIM, or DMARC setting that is wrong or missing, or a sender name that mimics a well-known brand.
- Someone reports receiving phishing emails "from us"Read: spoofing. Someone is abusing your sender name, not necessarily your actual mailbox.
- An email bounces (NDR): delivery failedThe NDR text usually states the exact reason. Reading it is step one.
None of the above fits?
Describe your situation below. We pass your input plus the steps you already saw to our AI and return tailored next-step advice. If it's too risky to DIY, we'll say so.
Or skip the DIY entirely
Our Managed IT clients do not look these things up. One point of contact, a fixed monthly price, resolved within working hours.