MailFixIt

SpamExperts setup

SpamExperts: DMARC fails for outbound filtered mail

The message needs either aligned SPF or aligned DKIM after it leaves the SpamExperts outbound filter.

Problem description

The visible symptom is:

Authentication-Results: spf=pass; dkim=pass; dmarc=fail header.from=example.com

Check the sending domain

Fix the DMARC failure

  1. Copy From, Return-Path, DKIM-Signature, and Authentication-Results from one failed message.
  2. Choose one aligned path: SPF or DKIM.
  3. For SPF, make the envelope domain align with From and authorize the SpamExperts outbound route.
  4. For DKIM, use a d= domain that aligns with From and assign its selector to the outgoing user.
  5. Start DMARC with p=none and a monitored rua address.
  6. Move to quarantine or reject only after every legitimate sender passes.

Common causes

SPF passes for an unrelated Return-Path, the DKIM selector is not assigned to the outgoing user, a message bypasses SpamExperts, or enforcement began before all senders were inventoried.

What the check proves

Public DNS shows policies and keys. A new message header shows the identities that actually passed or failed.

Frequently asked questions

How can DMARC fail when SPF passes?

SPF can pass for an envelope domain that does not align with the visible From domain. DMARC requires both pass and alignment for the SPF path.

Should I publish p=reject immediately?

No. SpamExperts recommends starting with p=none, reviewing reports, fixing every legitimate sender, and then moving to quarantine or reject.

Related email diagnostics

DMARC policy for the visible From subdomain is unexpectedFind the effective DMARC policy for a visible From subdomain. See whether p, sp, np or test mode applies before changing DMARC DNS. SpamExperts: DKIM signature is missing or failsFix missing or invalid DKIM on mail sent through the SpamExperts outbound filter. SpamExperts: SPF fails for outbound filtered mailFix SPF failure for outbound mail sent through SpamExperts Hosted Cloud or Local Cloud.

Primary sources: SpamExperts: set up DMARC.