MailFixIt

Cisco Secure Email setup

Cisco Secure Email: DMARC fails although SPF or DKIM passes

A valid SPF result or DKIM signature does not pass DMARC unless its domain aligns with the visible From domain.

Problem description

The visible symptom is:

Authentication-Results: spf=pass; dkim=pass; dmarc=fail header.from=example.com

Check the sending domain

Fix the alignment failure

  1. Read the visible From domain, SPF envelope domain, and DKIM d= domain from the same message.
  2. Choose one valid DMARC path: aligned SPF or aligned DKIM.
  3. For SPF, use an envelope domain that aligns with From and authorizes the final sending IP.
  4. For DKIM, sign with a d= domain that aligns with From and publishes the matching selector key.
  5. Keep relaxed alignment unless strict matching is required and every sender supports it.
  6. Send a new message and confirm dmarc=pass.

Important distinction

Cisco can verify inbound DMARC and can sign outbound mail with DKIM, but the domain owner publishes the DMARC policy. Changing a Cisco exception does not repair the sender’s alignment.

What the check proves

Public DNS can show the policies and keys. Message headers are still required to show which identities Cisco evaluated.

Frequently asked questions

How can DMARC fail when DKIM passes?

DKIM may pass for a different signing domain. DMARC also requires that domain to align with the visible From domain.

Does a correct DNS record prove the gateway is using it?

No. The gateway must also enable the matching route, signing profile, or policy. Confirm the result in a new message header.

Related email diagnostics

DMARC policy for the visible From subdomain is unexpectedFind the effective DMARC policy for a visible From subdomain. See whether p, sp, np or test mode applies before changing DMARC DNS. Cisco Secure Email: DKIM signature is missing or failsFix missing or invalid DKIM signatures on outbound mail sent by Cisco Secure Email Gateway. Cisco Secure Email: SPF fails for outbound mailFix SPF failure for mail sent through Cisco Secure Email Cloud Gateway or a managed appliance.

Primary sources: Cisco: DMARC identifier alignment.