DMARC fail: SPF and DKIM not aligned Email / SMTP Origin: Network OSI layer 7 · Application Last updated 4 Nov 2026

DMARC: dmarc=fail (p=REJECT) — SPF and DKIM pass but domains are not aligned with the From header

Authentication passed for another domain (your ESP's), but neither the SPF Return-Path domain nor the DKIM d= domain matches the visible From domain, so DMARC fails.

Exact message you may see dmarc=fail (p=REJECT)dmarc=fail (p=QUARANTINE)DMARC alignment failureUnauthenticated email from domain is not accepted due to the domain's DMARC policy550 5.7.1 DMARC policy reject
Explore the map of this error Full error map →
Seen on: SMTP

Meaning

DMARC needs at least one of SPF or DKIM to pass AND align with the From: domain. Using a third-party sender without custom domain authentication signs with the provider's domain. Configure custom DKIM (and a custom Return-Path/bounce domain) at the provider so d= equals your domain.

Common causes

  • ESP signing with its own domain (d=sendgrid.net)
  • Return-Path domain differs from From
  • Relaxed vs strict alignment setting (adkim/aspf=s)
  • Subdomain From with parent-only keys
  • Forwarding breaking SPF and no DKIM

⚡ Quick fix

  1. Enable custom domain authentication (DKIM CNAMEs) at the ESP
  2. Set a custom return-path/bounce domain
  3. Check adkim/aspf (use relaxed r unless needed)

Detailed fix by platform

Linux

  1. Read the headers Authentication-Results: for header.i= (DKIM d=) and smtp.mailfrom=; compare both with header.from=

How to diagnose

  1. From — Visible From domain?
  2. DKIM d= — Same organizational domain?
  3. Return-Path — Same domain?

🔧 Still not fixed?

Many errors look alike. If the steps above didn’t solve it, one of these is probably what you’re facing:

Where this error sits

Origin: Network. Errors that are often confused with or caused by this one (click to open):

530 5.7.0 Authentication Required — SMTP: 530 5.7.0 Must issue a STARTTLS command first / 530 5.7.1 Authentication required (Email / SMTP)530 5.7.0 Authenticat…534 5.7.9 Application-specific password required — SMTP: 534-5.7.9 Application-specific password required. Learn more at https://support.google.com/accounts/answer/185833 (Email / SMTP)534 5.7.9 Application…550 5.7.26 — 550 5.7.26 This mail has been blocked because the sender is unauthenticated (SPF/DKIM/DMARC) (Email / SMTP)550 5.7.26554 5.7.1 Message rejected as spam — SMTP: 554 5.7.1 Message content rejected / Your message looks like spam (spam score exceeded) (Email / SMTP)554 5.7.1 Message rej…DKIM: body hash did not verify — DKIM: dkim=fail (body hash did not verify) / signature verification failed (Email / SMTP)DKIM: body hash did n…DMARC: no record found — DMARC: dmarc=none (no DMARC record found for example.com) — bulk sender requirements not met (Email / SMTP)DMARC: no record foundIMAP: [AUTHENTICATIONFAILED] Invalid credentials — IMAP: NO [AUTHENTICATIONFAILED] Invalid credentials (Failure) (Email / SMTP)IMAP: [AUTHENTICATION…Mailgun: Sandbox domains are for test purposes only — Mailgun: 403 Forbidden — Sandbox subdomains are for test purposes only. Please add your own domain or add the address to authorized recipients (Email / SMTP)Mailgun: Sandbox doma…DMARC fai…

Explore the map of this error Full error map →

🧠 Still stuck? Analyze your error

Paste the full message, response headers or stack trace — we'll detect the platform and point to the most likely cause.

💬 What worked for others

No tips yet — did something else fix this for you?

Share what worked for you

Tips are checked by an editor before they appear. Links are removed.