What to Do When You Receive DMARC Failure Emails: A Practical Triage Guide

What DMARC failure emails actually tell you

A DMARC failure email lands in your inbox because your mail server received a message that failed DMARC checks. This does not automatically mean an attacker is trying to impersonate you. It means something in the authentication chain did not align with your published DMARC record.

The message could be one of three things: a spoofing attempt where someone else sent mail with your From address, a legitimate forwarded message that lost its authentication credentials somewhere in the chain, or a bulk sender or marketing platform that was never configured to authenticate on your behalf.

The confusion comes from the format. Most DMARC failure reports are machine-generated XML or plain text. They tell you what failed but not why, and not what to do next. That is what this guide fixes.

The three most common reasons you get DMARC failure emails

1. Spoofing: someone else is sending mail as your domain

A third party sent a message with your domain in the From header without your knowledge. Your DMARC policy caught it, the receiving server rejected or flagged it, and you got a failure report. This is DMARC working exactly as intended. The spoofing is external to your infrastructure and requires no action from your team beyond confirming that your domain is not actually sending that mail.

2. Forwarding: legitimate mail is breaking during delivery

When mail is forwarded through a chain that strips or rewrites headers, DKIM signatures break and SPF checks run against the forwarder instead of the original sender. A message that was fully authenticated at origin can fail DMARC at the final destination because the forwarding chain altered the authentication state. This is a common operational issue, not an attack.

3. Misconfigured third-party senders

Marketing platforms, CRM systems, support desks, and billing tools often send on behalf of your domain. If they have not been set up to DKIM-sign with your domain or use a subdomain that aligns with your DMARC policy, they generate consistent failure reports every time they send. This is a configuration problem, not a security incident.

How to read a DMARC failure email

Most DMARC failure reports follow the format defined in RFC 6591. Look for these fields:

• source_ip: the IP address that sent the message. Check it against your known senders.
• from: the domain in the From header. This is the domain your DMARC policy is evaluated against.
• dkim: whether DKIM passed or failed for the aligned domain.
• spf: whether SPF passed or failed for the aligned domain.
• result: the overall DMARC result (pass or fail).

If source_ip is not one of your own mail servers and the From domain is yours, you are likely seeing spoofing. If source_ip belongs to a known forwarding service or third-party platform and the message came from a legitimate correspondent, you are likely seeing a forwarding or configuration issue.

The DMARC failure triage decision tree

Run this check each time a failure report arrives:

1. Is the source IP one of your own mail servers?
- Yes: your server sent mail that failed DMARC. Check whether a recent configuration change broke DKIM signing or SPF alignment.
- No: go to step 2.

2. Is the source IP a known forwarding service or does the message come from a correspondent who forwards mail?
- Yes: likely forwarding-related DMARC failure. See the forwarding section below.
- No: go to step 3.

3. Is a third-party platform sending on your behalf without proper DKIM configuration?
- Yes: configure DKIM signing for that platform or add its sending subdomain to your DMARC alignment.
- No: likely spoofing. No action needed on your side.

Why individual failure emails are not enough on their own

Individual failure emails tell you one message failed. Aggregate DMARC reports, sent to your RUA (Reporting URI Aggregate) address, give you volume data: how many failures occurred, from which source IPs, over what time period. A single failure email might look alarming. An aggregate report showing 200 failures from the same IP over 24 hours, all from different recipient domains, is a clearer signal of a spoofing campaign.

This is also why DMARCFlow exists as a practical tool for this exact problem. Instead of reading individual failure emails one by one, DMARCFlow gives you a live dashboard view of all DMARC authentication results grouped by source IP, failure type, and domain. A spike in failures shows up as a trend, not a one-off alert. You can immediately tell whether the spike is spoofing, a forwarding problem, or a third-party sender that needs fixing. That context turns a cryptic failure email into an actionable next step. Aggregate reports also show your false positive rate, so you know whether a DMARC policy change is safe before you make it.

What to do for each scenario

Spoofing: no action needed on your side. Your DMARC policy is working. You may optionally notify the receiving domain that you detected a spoofing campaign using your domain, which helps them filter more effectively.

Forwarding: advise the sender. Ask them to use BCC forwarding instead of standard forwarding, or to send a fresh message directly. ARC (Authenticated Received Chain) can help forward-aware servers preserve authentication results through a forwarding chain, but it requires support from both the original sender and the forwarder.

Misconfigured third-party sender: fix the integration. Configure DKIM signing for the platform using your domain's selector. If the platform cannot DKIM-sign with your domain, use a subdomain such as marketing.yourdomain.com that is covered by your DMARC policy through subdomain alignment.

FAQ

Are DMARC failure emails dangerous?

Not necessarily. Most DMARC failures from known senders are operational issues like forwarding or misconfigured third-party platforms. Spoofing attempts caught by DMARC are a sign your policy is working, not a sign you are under attack.

Why do I get DMARC failure emails for mail I did not send?

You are seeing mail from other domains claiming your domain in the From address. Your DMARC policy rejected or flagged those messages and you received the failure report. This is normal DMARC operation.

Should I change my DMARC policy if I see failures?

Only after you have reviewed aggregate reports and confirmed that legitimate mail is not being rejected. Rushing to p=quarantine or p=reject before understanding your false positive rate can break legitimate mail flows.

Can forwarded mail pass DMARC?

Standard forwarding often breaks DKIM because the forwarding server rewrites headers. Using ARC or switching to BCC forwarding preserves authentication. Some forwarders are forward-aware and handle this correctly, but many are not.

What is the difference between DKIM fail and DMARC fail?

DKIM fail means the message signature did not verify against the published DKIM record. DMARC fail means neither DKIM nor SPF aligned with your From domain. A DKIM failure alone does not cause a DMARC failure if the other mechanism aligns. Both must fail for DMARC to fail.