How to Fix DMARC Errors
DMARC failures usually come from one of three places: an invalid DNS record, a policy that is not formatted correctly, or a message that does not align with SPF or DKIM. Work through the checks below in order so you fix the underlying cause instead of weakening the policy.
1. Check that the DMARC record exists
DMARC must be published as a TXT record at _dmarc.yourdomain.com. The value must begin with v=DMARC1; and include a policy.
v=DMARC1; p=none; rua=mailto:[email protected]Use the MailTested DMARC Checker to confirm that public DNS returns exactly one valid DMARC record.
2. Repair syntax and policy errors
Use a supported policy: none, quarantine, or reject. Separate tags with semicolons, remove smart quotes, and make sure percentage values stay between 0 and 100.
3. Fix SPF alignment
SPF alignment requires the domain authenticated by SPF to match, or be an allowed subdomain of, the visible From domain. Check the sending service, envelope-from domain, and SPF authorization together.
4. Fix DKIM alignment
DKIM alignment requires the signing domain in the DKIM signature to align with the visible From domain. Confirm the selector exists, the public key is complete, and the sending platform signs with your domain instead of a provider-owned domain.
5. Validate reporting addresses
Addresses in rua and ruf must use valid mailto: values. If reports are sent to another domain, that destination may need an authorization record before receivers will send aggregate data.
6. Increase enforcement gradually
Start with p=none while reviewing reports. Move to quarantine, then reject, only after legitimate mail streams pass SPF or DKIM alignment consistently.
Final verification
After DNS propagates, run the DMARC checker again and send a fresh message through MailTested. A successful result should show a valid policy plus aligned SPF or DKIM authentication.