Why Do Thousands of My Emails Fail DMARC Authentication But a Few Pass?

The Ratio That Worries People

You open your DMARC aggregate report and see two numbers: 12,650 failures, 179 passes. The instinct is to panic. Something must be broken. Your domain is being spoofed at scale.

Usually, it is neither.

The ratio between failures and passes in a DMARC aggregate report is misleading by design if you do not know what each number counts. Failures almost always outnumber passes for a simple reason: the failure column counts every single sending attempt that did not meet alignment requirements. The pass column counts the specific message streams that authenticated correctly against your domain. One of those groups is much larger than the other.

What Your DMARC Report Actually Counts

A DMARC aggregate report is a summary of authentication results for your domain over a time period, usually 24 hours. It comes from the mail servers that receive mail from your domain. Those servers run SPF, DKIM, and DMARC checks on every message and report the results.

Two things to understand immediately:

Pass does not mean the message was safe. It means the sending server authenticated correctly against your domain's sending infrastructure. A legitimate newsletter service that properly aligns its DKIM signature passes DMARC. A spoofing attacker who uses a server with matching alignment also passes DMARC. Pass means alignment, not intent.

Fail does not mean the message was malicious. It means the sending attempt did not meet alignment requirements. Forwarded mail fails. Mailing list servers fail. Legitimate CRM platforms that send from addresses matching your domain but use their own infrastructure without proper alignment fail. None of these are attacks.

The ratio between the two numbers tells you about the diversity of your sending landscape, not the severity of an attack.

Why Failures Usually Vastly Outnumber Passes

For most domains, the failure count is larger because most sending attempts on behalf of your domain do not come from your own configured infrastructure.

Forwarded email is the most common cause. When someone forwards a message from their inbox to yours, their server tries to deliver it using its own SMTP session. The original SPF record covers their domain, not yours. Any DKIM signature was added by their server and covers their domain. Neither aligns with your From header. The forwarded message fails DMARC even though it is genuine.

Some forwarding chains support ARC (Authenticated Received Chain), which preserves authentication results through the forwarding hop. Most personal forwarding does not use this reliably enough to produce consistent DMARC passes. Forwarding failures remain normal.

Mailing lists modify messages before relaying them. They often strip or replace the DKIM signature. Some add custom headers that break alignment. The relayed result typically fails DMARC for the same reason as personal forwarding.

Third-party senders are the other major contributor. Marketing automation platforms, CRM systems, support desk tools, billing software — any service that sends from addresses appearing to come from your domain but uses its own infrastructure must configure alignment. If DKIM signing or SPF is not set up to align with your domain, every message from that service appears as a DMARC failure. Many services do not set this up correctly by default.

Spoofing attempts also appear as failures. When an attacker tries to send mail appearing to come from your domain, their messages fail DMARC if your domain is properly protected. These failures are the point. They are evidence that your policy is working.

Reading the Ratio Without Panic

The absolute numbers do not tell you whether something is wrong. The source of the failures does.

Look at the failure details in your aggregate report. Specifically, check the alignment result for each sending IP. You want to see:

- Which sending IPs are generating the most failures? 
- Are those IPs you recognize as your own legitimate senders? 
- Are they third-party services that have not been configured for alignment? 
- Are they IPs you do not recognize at all?

If the IPs generating the most failures are services you actively use that have not been set up for alignment, that is a fixable configuration problem. Add DKIM keys for those services to your DNS, or ensure their DKIM signing aligns with your domain. The DMARC report tells you exactly which services are causing the problem — you just have to look at the right column.

If the IPs are external and not recognizably associated with any service you use, those failures are likely spoofing attempts. That is the expected outcome for a domain with p=quarantine or p=reject.

When the Ratio Changes Suddenly

A sudden spike in failures — or an unexpected drop in passes — is worth investigating. Possible causes:

- A new third-party service was added to your sending workflow without proper alignment 
- A marketing platform changed its sending infrastructure and broke DKIM signing 
- A forwarding service your users rely on changed how it relays messages 
- Your own sending infrastructure developed an alignment problem

An unexpected drop in failures can also signal a problem. If you suddenly see very few failures from a domain that previously had high failure volume, it may mean your DMARC reports are not being received, or that a previously problematic sender has been taken offline.

The Goal Is Not Zero Failures

Most domains that send email through multiple services, handle forwarding, or support mailing lists will always have more DMARC failures than passes. This is normal. The goal is not a clean ratio. The goal is:

- All legitimate senders are properly authenticated and aligned 
- No unauthenticated mail appears to come from your domain 
- Your failure sources are understood and intentional

If your sending infrastructure is correctly configured, your passes represent your known, approved sending streams. Your failures represent either spoofing attempts that your policy blocked, or senders you have not yet brought into alignment. Neither is a crisis.

FAQ

Is it normal for DMARC passes to be much lower than failures? 
Yes. For most domains that handle forwarding, use third-party email services, or have mailing lists, failures typically outnumber passes. This is expected behavior, not a configuration error.

Should I worry if I see 10,000 DMARC failures a day? 
Only if the failures come from sending IPs you control and have not yet configured for alignment. If the sending IPs are external or not recognizably yours, those failures are likely spoofing attempts that your DMARC policy blocked.

Does a high failure rate mean my DMARC policy is not working? 
No. DMARC failures mean the policy is being evaluated. A p=reject policy that generates failures means the policy is actively rejecting unauthenticated mail. What you want to check is whether your legitimate senders are passing DMARC, not whether the failure count is low.

Can forwarded email pass DMARC? 
Only in limited cases. If the forwarding chain uses ARC (Authenticated Received Chain) and both the original sender and the forwarding service support it, the forwarding server may pass DMARC based on the preserved ARC results. Most personal forwarding does not use ARC reliably, so forwarded mail typically fails DMARC even when it is legitimate.

Why do some marketing platforms generate DMARC failures? 
Marketing automation platforms, CRMs, and billing systems often send from their own infrastructure using addresses that appear to come from your domain. By default, their servers do not align with your domain in DMARC terms. To fix this, add DKIM keys for that platform to your DNS, or ensure the platform uses custom DKIM signing that aligns with your domain.