Guide
How to investigate DMARC problems
Understand DMARC alignment failures, policy issues, and their impact on email deliverability.
The situation
DMARC failures occur when a message does not pass SPF or DKIM alignment checks. The DMARC policy then determines what happens to that message — nothing (p=none), quarantine, or rejection. Understanding which check is failing and why is essential before changing any configuration.
Before you begin
For agencies: DMARC policy changes can have significant deliverability consequences. Always review aggregate reports before tightening policy, and confirm approval before applying changes.
The operational path
The goal isn't just to find the error. The goal is to move from detection to a verified infrastructure state.
What could have caused this?
Cause
What changed
Possible impact
SPF not aligned
Sending domain does not match From domain
DMARC SPF alignment fails
DKIM not aligned
Signing domain does not match From domain
DMARC DKIM alignment fails
Both checks failing
Neither SPF nor DKIM passes alignment
DMARC fails — policy applied
Policy too strict
p=reject before authentication is stable
Legitimate mail rejected
Missing rua address
No reporting address configured
No aggregate data to investigate with
Step by step
Review the DMARC record and recent aggregate reports to understand the current authentication state.
What to check
Expected result: You now know the current policy and have data on which senders are failing DMARC checks.
With Infraova
Infraova ingests DMARC aggregate reports and surfaces alignment failures by sending source — so you know which platform is failing before you start investigating manually.
DMARC requires either SPF or DKIM to pass alignment. Determine which is failing and why.
What to check
Expected result: You know which alignment check is failing, for which sender, and whether it is an authentication problem or a configuration problem.
The fix depends on which check is failing. SPF alignment failures typically require envelope-from configuration changes on the sending platform. DKIM alignment failures require the sending platform to sign with the correct domain.
What to check
With Infraova
Infraova proposes the specific configuration change needed — not a generic suggestion. The proposal includes the exact record value and the reason before your team reviews it.
Apply the approved change and confirm alignment is passing before tightening policy further.
What to check
Expected result: Alignment is passing, the change is documented, and the domain is ready for the next policy step.
You decide. Infraova executes.
Infraova can propose and execute an approved infrastructure change, but it does not independently decide to modify client infrastructure. Every proposed change requires explicit authorization before execution.
Key takeaway
DMARC problems are almost always alignment problems. Find which check is failing, for which sender, fix the alignment configuration on the sending side, verify the result, and only then consider tightening the policy.
Turn this playbook into a continuous workflow
Without Infraova
With Infraova
The guide teaches you how to solve the problem once. Infraova keeps watching for it after you're done.
Continue the playbook
Want the product-level details?
Guides answer "How do I solve this?" Documentation answers "How does Infraova work?"
Stop discovering infrastructure problems manually.
Infraova continuously monitors your client and business infrastructure, identifies meaningful problems, proposes the next action, executes approved changes, and verifies the result.