What 12,650 DMARC Failures Mean - Plain-Language Guide

You enabled DMARC. You started receiving aggregate reports. The first number you see looks like this: 12,650 failures, 179 passing.

That ratio -- 98.6% failure -- looks alarming. But before you panic, you need to understand what DMARC actually measured. The number does not mean what most people think it means on first read.

This guide explains what your DMARC failure data is actually showing, why failures happen, and the specific steps that fix each failure type.

What DMARC is actually measuring

DMARC does not run its own authentication checks. It asks two existing protocols -- SPF and DKIM -- to do the heavy lifting, then applies a third rule called alignment.

Here is how it works in sequence:

Step 1: SPF check -- The receiving mail server looks up the sender's SPF record and checks whether the sending server is allowed to send email for that domain.

Step 2: DKIM check -- The receiving server verifies that the email has a cryptographic signature that proves it was not modified in transit and that the signature belongs to the stated domain.

Step 3: Alignment check -- Even if SPF or DKIM passes, DMARC requires that the domain used in the check matches the domain shown in the email From address. A pass from newsletter.example.com does not align with a message From support@example.com.

For DMARC to pass, you need at least one of SPF or DKIM to pass AND alignment to match. This is why a message can fail DMARC even when SPF and DKIM both technically pass -- alignment is the gatekeeper.

Why 12,650 messages failed and 179 passed

There are four distinct failure categories in a DMARC aggregate report. The 12,650 failed number is a sum of all of them. Here is what each one means:

SPF hard fail -- The sending server is not on the SPF allowlist for the domain. This typically happens when legitimate email is sent from an IP or service that was not included in the domain SPF record.

SPF soft fail -- The sending server is in a neutral or softfail state in the SPF record. Some configurations treat softfail as a failure, which is what happens when your DMARC policy is set to reject.

DKIM fail -- The email was not signed with a valid DKIM key for the domain, or the signature was invalidated because the message was modified in transit. This is one of the most common causes of DKIM-related failures, particularly for transactional email sent through third-party platforms.

Alignment fail -- SPF or DKIM passed, but the domain that authenticated the message does not match the From domain. This is the most misunderstood failure type. It catches misconfigured third-party senders, forwarded messages, and internal relay chains where the sending system uses its own domain rather than the brand domain.

The 179 messages that passed DMARC did so because they had at least one valid authentication result (SPF or DKIM) with a domain that aligned with the From address. The 12,650 that failed did not meet that combined condition.

Is a 98.6% failure rate normal?

No. Not for a domain that is actively sending wanted email.

Some failure is expected. Even well-configured domains typically see 1% to 5% of legitimate mail fail DMARC due to forwarding, internal relays, or third-party services that have not been onboarded into the authentication system. A 98% failure rate almost always means one of three things:

You have a third-party sending service that is not properly authenticated. This is the most common cause. Marketing automation platforms, CRM tools, invoicing software, and support systems often send email from your domain without being included in your SPF record or having DKIM keys configured.

Your domain was spoofed. DMARC is working as intended and catching forged messages that pretends to come from your domain. In this case, the 12,650 failures are not your email -- they are attack attempts that were rejected. This is a good outcome, but it means you should check whether your domain is being used in a phishing campaign.

Your mailing list or internal relay is breaking authentication. Email forwarded through mailing lists, collaboration tools, or internal SMTP relays often loses DKIM signatures and triggers alignment failures.

How to diagnose which failure type you have

Open your DMARC aggregate report and look at the source type and result fields. The pattern tells you where to focus:

If you see many fail results with a consistent external sending IP, that IP is likely a third-party service sending on your behalf. Add it to your SPF record or set up DKIM for it.

If you see DKIM failures from a service you control, check whether DKIM signing is enabled for that sending domain. Many platforms disable DKIM by default and require you to add the DKIM record to your DNS.

If you see alignment failures from IP addresses you do not recognise, those are likely forwarded messages or attempted spoofing. Forwarded mail that loses DKIM alignment cannot be fixed on your end -- the recipient mail system is breaking the chain. For spoofing attempts, your DMARC policy at reject is correctly blocking them.

How to fix SPF failures

SPF failures happen because the sending IP is not in your SPF record. The fix is to add the sending source to your SPF record. Common additions include:

Your email marketing platform sending IPs or include mechanism
Your CRM or sales engagement tool
Your accounting or invoicing software
Your cloud productivity suite (Microsoft 365, Google Workspace)
Any legacy on-premises mail server

Add each service as an include mechanism in your SPF record. Keep your SPF record under the 10-DNS-lookup limit, as going over causes all SPF checks to return softfail. If you have many third-party senders, consider moving to a flattened include list rather than chained includes.

How to fix DKIM failures

DKIM failures usually mean one of two things: the sending service does not have DKIM enabled, or the DKIM key stored at the registrar does not match the private key the service is using to sign.

For third-party platforms, you typically need to generate a DKIM key in the platform, add the TXT record to your DNS, and wait for propagation. Some platforms rotate DKIM keys automatically and require you to update your DNS records periodically.

For your own mail servers, check whether your MTA (Mail Transfer Agent) is signing outgoing mail with DKIM. OpenDMARC, rspamd, and Haraka all have DKIM signing capabilities. If you are using Exchange Server, you need to configure DKIM signing via a third-party plugin or gateway.

How to fix alignment failures

Alignment is the most commonly misunderstood DMARC failure type because it can occur even when SPF and DKIM individually pass.

Alignment requires that the domain in the RFC 5321 MAIL FROM (SPF) or the DKIM-Signature domain (DKIM) matches the RFC 5322 From domain exactly, or is a parent domain.

Common alignment failure causes:

Internal mail relays that use their own domain in the MAIL FROM. The relay authenticates with its own domain, but the original From address is your brand domain. DMARC sees a mismatch.

Third-party platforms that send using their own infrastructure domain in the MAIL FROM, even when the From address shows your domain. This is why you need to configure the platform to use your domain, not their default sending domain.

Mailing lists that rewrite the From address. This is a known DMARC incompatibility. Some mailing list providers offer alignment modes that preserve the original sender domain.

Forwarded email. When a message is forwarded, the forwarding server becomes the new sender from DMARC perspective. This is not fixable from your end, but it is a signal that the recipient mail system may be doing something unusual.

What to do when the failure rate is almost 100%

A near-total failure rate almost always points to the same root cause: a high-volume sending source that is not authenticated at all. This is often:

A marketing platform that was set up by a team member who did not know about SPF and DKIM requirements. Transactional email sent from a CRM, support tool, or billing system that predates your DMARC rollout. Legacy infrastructure that sends on behalf of multiple domains without individual DKIM configuration.

Go through your sending sources systematically. If you do not know what is sending email from your domain, start with a DNS query to find all your SPF records, then cross-reference with your DMARC aggregate report to see which sending IPs are in your record and which are not.

How to track failure rates over time

Once you fix the immediate causes, you need to monitor whether your failure rate is improving. DMARC aggregate reports are delivered to the rua address you specified in your DMARC record. You can parse them manually, or use a monitoring tool to track trends.

Tools like DMARCFlow aggregate your reports and show you which sending sources are getting more or fewer failures over time, which helps you prioritize onboarding efforts. Monitoring is especially important after you move your DMARC policy to reject -- any unonboarded sending source will immediately start bouncing, and you want to catch that before it affects real email flow.

Summary: Your DMARC failure interpretation checklist

Here is the diagnostic sequence to run when you see a high DMARC failure rate:

1. Check whether the failing IPs are in your SPF record. If not, add them.
2. Check whether your DKIM record is published and matches what your sending systems are using.
3. Identify which sending services send high volumes from your domain. Onboard each one to SPF and DKIM.
4. Look at the alignment results. Alignment failures from sending services mean the service is not configured to send from your domain properly.
5. If you see failures from IPs you do not recognise and your domain is publicly known, your DMARC is catching spoofing attempts. This is working as intended.
6. If you recently moved to p=reject and see a spike in failures, you likely have an unauthenticated sending source. Revert to p=none temporarily and onboard the missing source before trying reject again.

The 12,650 failures in the original scenario were most likely a combination of one or more unauthenticated third-party senders and possibly some alignment issues from internal relays. Adding the missing sending sources to SPF, enabling DKIM for the sending platform, and checking alignment configuration would likely bring that failure rate down to the 1% to 5% range that is normal for a well-operated domain.

FAQ

What is a normal DMARC failure rate?
A well-configured domain sending legitimate email should see 1% to 5% of messages fail DMARC. Failures above that range usually indicate an unauthenticated sending source that needs to be onboarded.

What does SPF fail mean in a DMARC report?
It means the sending server is not authorised in your SPF record. Check whether the IP belongs to a legitimate sending service that needs to be added to your SPF record.

What does DKIM fail mean?
The email was not signed with a valid DKIM key for the domain, or the signature was invalidated because the message was modified in transit. Verify that DKIM is enabled on the sending platform and that your DKIM DNS record is correct.

What is DMARC alignment?
Alignment means the domain that authenticated the email (via SPF or DKIM) matches the From domain shown to recipients. A message can pass SPF or DKIM individually but still fail DMARC if the authenticated domain does not match the From domain.

Should I move to p=reject if I have many failures?
No. Move to p=reject only after you have onboarded all legitimate sending sources and your failure rate is stable below 5%. Moving to reject too early will bounce legitimate email from unauthenticated sources.

How do I reduce DMARC failures without breaking email?
Onboard every legitimate sending source to SPF and DKIM. Configure third-party platforms to send using your brand domain in both the MAIL FROM and the From address. Monitor aggregate reports weekly during the onboarding period. Only move to p=reject once you have confirmed all major sending sources are authenticated.