SPF, DKIM or DMARC failing? How to read the result and fix it

The short version

1. Find the authentication results. Open a message you sent and view its original source or full headers.
2. What the SPF results mean. Pass means the sending IP is listed.
3. What the DKIM results mean. Pass means the signature matched the published key.
4. What the DMARC results mean. DMARC passes when SPF or DKIM passes and the domain that passed aligns with the From domain.
5. Fix: no SPF record found. This means the domain has no SPF TXT record, or the lookup is for a different name than the one you published.
6. Fix: DKIM key not found or invalid. Check the selector in the message's DKIM-Signature header, the s= value, and confirm a TXT record exists at selector._domainkey.yourdomain.com.

Find the authentication results

Open a message you sent and view its original source or full headers. Look for a header called Authentication-Results, added by the receiving server. It shows a result for each check, such as spf=pass, dkim=pass and dmarc=pass, along with the domain each check used.

Our free email header analyzer reads these headers for you if the raw text is hard to follow.

What the SPF results mean

Pass means the sending IP is listed. Fail means it is not and the record says to reject. Softfail means it is not listed and the record says to treat the message with suspicion. Neutral and none mean the record makes no claim or does not exist. Temperror is a temporary DNS problem, and permerror means the record is broken, for example two records or too many lookups.

If you see permerror, fix the record itself. If you see softfail or fail from a service you use, that service is missing from your record.

What the DKIM results mean

Pass means the signature matched the published key. Fail means it did not. The common causes are a message changed after signing, such as a footer added by another system, a DNS record that was copied wrongly, or a selector that does not match what the sender used.

None means the message was not signed at all. Check that DKIM is switched on for the sending service and that your DNS record is published at the exact name it shows.

What the DMARC results mean

DMARC passes when SPF or DKIM passes and the domain that passed aligns with the From domain. So you can see spf=pass and dkim=pass and still get dmarc=fail, because the passing domains belong to the service and not to you.

That is the most confusing case. The fix is to authenticate your own domain with the sending service, so its DKIM signature, and ideally its return path, use your domain.

Fix: no SPF record found

This means the domain has no SPF TXT record, or the lookup is for a different name than the one you published. Check that the record is at the root of the exact domain in the Return-Path, and that you did not put it on a subdomain by accident.

Remember that mail can come from a subdomain, which then needs its own record. See our SPF guide for how to build one.

Fix: DKIM key not found or invalid

Check the selector in the message's DKIM-Signature header, the s= value, and confirm a TXT record exists at selector._domainkey.yourdomain.com. Long keys must be pasted as one value. Some DNS panels split or truncate them, so verify by looking the record up after publishing.

If you recently changed provider or rotated keys, an old selector may still be in use. Publish the new records and wait for DNS to spread before switching signing on.

Fix: DMARC fails but SPF and DKIM pass

Compare the domain in the From header with the domains that passed. If they differ, alignment fails. Set up a custom domain in your sending service so DKIM signs with your domain.

If you are not sure which domains are involved, the DMARC aggregate reports list them by source, and they will show exactly which senders are not aligned.

Fix: it passes everywhere but still goes to spam

Authentication is a requirement, not a guarantee. If everything passes and mail still lands in spam, the cause is usually reputation, content or the list: high complaint rates, purchased addresses, a sudden jump in volume, or a spammy subject line.

Check your complaint and bounce rates, review who you are sending to, and slow down if you recently increased volume. Our deliverability guides cover these steps.

A calm order of work

Start with SPF, because it is quickest to fix. Then check DKIM for each sender. Then look at DMARC alignment. Change one thing at a time and re-test, so you know which change worked.

If you get stuck, send us the message headers and your domain name and we will help you find which check is failing and why.

An example header

A typical result line reads: Authentication-Results: mx.example.net; spf=pass smtp.mailfrom=bounce.yourdomain.com; dkim=pass header.d=yourdomain.com; dmarc=pass header.from=yourdomain.com. Each part names the domain that was checked.

Read it from the right. The header.from domain is what the recipient sees. The dkim header.d and spf smtp.mailfrom domains are the ones the check used. If they differ from header.from and are not subdomains of it, expect an alignment failure.

Further reading and sources

• RFC 7208: Sender Policy Framework (SPF)
• RFC 6376: DomainKeys Identified Mail (DKIM) Signatures
• RFC 7489: DMARC

Related guides and tools

• Email header analyzer: Read authentication results in plain language.
• How to create an SPF record: Syntax, examples and common errors.
• How to set up DMARC: Start with p=none and move to reject safely.