Mimecast Cloud Gateway setup

Mimecast: DMARC fails although SPF or DKIM passes

DMARC needs one passing authentication method whose domain aligns with the visible From domain.

Problem description

The visible symptom is:

Authentication-Results: spf=pass; dkim=pass; dmarc=fail header.from=example.com

Check the sending domain

Fix the DMARC failure

Copy the Mimecast Authentication-Results header from the failed message.
Compare the visible From domain with the SPF envelope domain and DKIM d= domain.
Choose one aligned path.
For SPF, make the envelope domain align with From and authorize Mimecast.
For DKIM, configure Mimecast to sign with an aligned d= domain and publish its selector key.
Send a new message and confirm dmarc=pass.

Common causes

A third-party Return-Path passes SPF but does not align, Mimecast signs with another domain, the DKIM key is stale, or strict alignment rejects a valid subdomain design.

What the check proves

Public DNS shows the policies and keys. The message header shows the identities that were actually tested.

Frequently asked questions

Why can Mimecast report DMARC fail after SPF pass?

SPF may pass for a Return-Path domain that does not align with the visible From domain. DMARC requires both SPF pass and SPF alignment for that path.

Does a correct DNS record prove the provider is using it?

No. The provider must also activate the matching route or signing policy. Confirm the result in its console and in a new message.

Related email diagnostics

DMARC policy for the visible From subdomain is unexpectedFind the effective DMARC policy for a visible From subdomain. See whether p, sp, np or test mode applies before changing DMARC DNS. Mimecast: DKIM signature is missing or failsFix a missing or invalid Mimecast DKIM signature by matching the outbound definition, selector, and public key. Mimecast: SPF fails for outbound mailFix SPF failure when Mimecast Cloud Gateway sends outbound mail for your domain.

Primary sources: Mimecast: DNS Authentication overview.