Why Your DMARC Report Shows Thousands of Failures But Your Mail Seems to Be Getting Through

You open your DMARC report. You see 12,650 failures and 179 passes. Your first reaction is that something is broken.

It might not be.

The gap between your failure count and your pass count is often exactly what DMARC is supposed to show you. The confusion usually comes from one thing: most people read DMARC failure counts as if they meant "messages that did not arrive." In reality, they mean something more specific and more useful than that.

This post explains what your DMARC report is actually counting, why you might see thousands of failures alongside mail that is genuinely arriving, and how to work through the most common causes.

What Your DMARC Report Is Actually Counting

Your DMARC aggregate report is a digest from recipient mail servers. Each entry represents how a receiving server evaluated one piece of mail from your domain during a specific delivery attempt.

Here is the part that trips up almost everyone: an entry is generated every time a receiving server processes a receipt of your mail, not every time you send a message.

Send one newsletter to 10,000 recipients across Gmail, Microsoft 365, and a dozen smaller providers. Your mail server delivers it. The campaign platform delivers it. The receiving servers each run SPF, DKIM, and DMARC alignment checks on their end. Each individual receipt generates a record. Your aggregate report now has roughly 10,000 entries.

If any of those receipts failed SPF, DKIM, or alignment, they show up in the failure count. The 179 passes in the original scenario are the receipts where everything aligned correctly. The 12,650 failures are the receipts where something did not.

Your mail may have arrived at most of those 12,650 recipients. The failures in the report mean a receiving server evaluated your mail and found an authentication or alignment problem. Many receivers accept mail regardless of DMARC failures. DMARC tells receivers what to do with failures; it does not force them to reject.

This is why a high failure count and healthy mail delivery can coexist. The report is measuring something different from delivery rates.

The Difference Between Authentication Passing and Alignment Passing

To understand the failure count, you also need to separate two concepts that DMARC blends together: authentication and alignment.

SPF and DKIM are authentication mechanisms. They answer the question: can this mail server prove that the sending infrastructure is authorized?

SPF checks whether the sending server’s IP is listed in your domain’s SPF record.

DKIM checks whether the message was signed with a private key corresponding to a public key published in your DNS.

Both can pass. A receiving server can then evaluate alignment.

DMARC alignment asks a different question: does the From header domain match the domain that passed SPF or DKIM?

A message can pass SPF and DKIM but still fail DMARC if the From address shows “example.com” but the SPF check validated “mail.example.com” or the DKIM signature covered “sendgrid.com.” The From header domain and the authenticated domain do not match, so DMARC alignment fails.

This distinction matters because most DMARC failure counts you will ever see are alignment failures, not authentication failures. Your own mail servers pass SPF and DKIM. Your third-party platforms probably pass SPF and DKIM for their own domains. But if either is sending as your domain without aligned credentials, every single receipt generates a DMARC alignment failure.

Why You See Thousands of Failures

Here are the most common reasons for a high DMARC failure count with mail that appears to be flowing normally.

Third-party email platforms and marketing automation

This is the most frequent cause. You use a marketing platform, a transactional email service, or a CRM to send mail as your domain. The platform passes its own SPF check and signs its own DKIM. But neither credential aligns with your From header domain.

Every recipient server receives a message with a From header showing yourdomain.com, while SPF validates the platform’s IP and DKIM validates the platform’s domain. DMARC alignment fails. Your aggregate report logs a failure for each individual receipt.

Your marketing team sees opens, clicks, and reply conversations. The mail is arriving. Your DMARC report is showing you the authentication gap.

Subdomains sending without aligned credentials

Many organizations have subdomains used for different sending purposes: marketing.example.com, support.example.com, notifications.example.com. Each subdomain needs its own SPF record and DKIM key pair to pass DMARC alignment when used as a From header domain.

If a subdomain is sending without aligned SPF or DKIM, every receipt from that subdomain generates a DMARC alignment failure. The failures are real. Mail may still arrive because receivers do not always enforce strict DMARC policy at the mailbox provider level.

Forwarding

When a message is forwarded, the forwarding server becomes the new sender from the receiving server’s perspective. The From header still shows your domain. The forwarding server’s SPF check runs against its own infrastructure. Alignment fails.

Forwarding-related failures are scattered across many receiving servers and often appear without a clear pattern in your sending infrastructure.

Mailing lists

Mailing list software often rewrites the From header to the list’s own address. The original From domain disappears. Alignment fails. Every subscriber’s server receives a message that fails DMARC.

Many major mailing list operators are aware of this and take steps to mitigate it, but it remains a common source of spurious DMARC failures.

A Worked Example: 12,650 Failures, 179 Passed

This specific scenario is worth walking through in detail because it illustrates how the numbers add up.

You send one marketing campaign to your full list of 12,000 contacts. Your campaign platform delivers the mail to all 12,000 recipients. Additionally, you send 179 internal emails from your own mail server to colleagues on your primary domain.

Your campaign platform is not aligned with your domain. All 12,000 campaign receipts fail DMARC alignment. Your own mail server is aligned. All 179 internal emails pass.

Your aggregate report shows approximately 12,000 failures and 179 passes.

The 179 passes are not your “good mail” versus bad mail. They are the emails that happened to use your correctly configured infrastructure. The 12,000 failures are not rejected mail. They are receipts where the campaign platform’s infrastructure did not align with your From domain.

The real story here: your internal email is fine. Your campaign platform needs to be reconfigured. The mail arrived; the authentication did not.

This is why reading DMARC reports as “delivery rates” produces the wrong conclusion. The failures here are a configuration signal, not a delivery signal.

How to Diagnose High DMARC Failure Counts

Use this checklist to work through the most likely causes in your own reports.

1. Identify the failing source IPs

Look at the source IPs listed in your failure rows. Are they your own mail server IPs, or are they addresses you do not recognize?

If you see IPs from cloud hosting providers, email marketing platforms, or SaaS tools you use, that points directly to a third-party sending gap.

2. Check whether failures are in SPF, DKIM, or alignment

If failures are concentrated in alignment (pass SPF, pass DKIM, fail DMARC), your sending infrastructure is authorized but not aligned with your From domain. This is the most common scenario with third-party senders.

If failures are in SPF, the sending IP is not authorized in your SPF record. If failures are in DKIM, the message was not signed or the signing domain does not match.

3. Look at the From domains in the failure rows

If the failing From domains are subdomains of your primary domain (for example, marketing.example.com, notifications.example.com), those subdomains need their own aligned SPF and DKIM configuration.

4. Check timing patterns

If failures spike during specific campaigns or regular intervals, look at which platform was used for those sends. If failures are more uniform across the day, check transactional email sources like order confirmations, password resets, and notifications.

5. Look for forwarding signatures

If failures show ARC (Authenticated Received Chain) seals, the mail passed through a forwarding server before arriving at the final recipient. Forwarding-related failures are typically scattered across many source IPs and do not cluster around your own infrastructure.

6. Use a tool to group failures by source

Parsing raw XML or CSV DMARC reports manually is slow and error-prone. DMARCFlow processes your aggregate reports and groups failures by source IP and type, so you can see which sending infrastructure is causing the most alignment failures without manually correlating thousands of receipt records. This also makes it easier to track whether the failure pattern is improving or degrading over time, which is harder to see when you are looking at static report files.

What to Do After You Find the Cause

Once you have identified which scenario matches your situation, here is what to do next.

For third-party platforms, the fix is usually to set up custom DKIM keys with the platform so your domain is the signing domain, or add the platform’s sending IPs to your SPF record. Either approach restores alignment.

For subdomain sending gaps, publish a DMARC record that covers your subdomains (start with sp=none to avoid breaking anything) while you audit what each subdomain is actually sending. Then configure aligned SPF and DKIM for each subdomain before tightening the policy.

For forwarding, the proper solution is ARC (Authenticated Received Chain), a protocol that lets forwarding servers preserve the original authentication results. The destination server can then see that the mail was authenticated before it was forwarded. ARC adoption is growing but still not universal.

For mailing lists, the standard fix is SRS (Sender Rewriting Scheme), which rewrites the bounce address to maintain alignment when mail is forwarded through a list server.

The Short Version

Thousands of DMARC failures do not automatically mean broken mail. They usually mean your sending infrastructure has a configuration gap that DMARC is correctly identifying.

The most common cause is third-party platforms sending as your domain without aligned authentication credentials. The mail arrives; the authentication fails. The fix is aligned SPF or DKIM with your sending platforms.

Your aggregate report is working. The failure count is the signal. DMARCFlow helps you translate that signal into a specific cause and a specific fix, without having to parse XML files by hand.

Start with your next aggregate report. Work through the checklist. Identify which sending infrastructure is generating the failures. Then close the gap.