DMARC Failure Diagnoser

"DMARC failed" — what just happened?

DMARC failure shows up in three places: aggregate (rua) reports sent daily by every major receiver, forensic (ruf) reports sent on-demand for individual failed messages, and bounce messages with strings like "550 5.7.1 DMARC verification failed" or "550 5.7.515 Access denied, sending domain <domain> does not meet the required authentication level." (the rejection Microsoft documents for Outlook.com high-volume senders; Junk placement has applied since 5 May 2025).

DMARC fails when neither SPF nor DKIM passes aligned against the From-header domain. The tool above scans your domain's posture and lists the most likely root causes — ranked by impact — so you can act on the most-broken thing first.

The five common causes

1. No DMARC record at all. Less common in 2026 but still happens. The fix is publishing a starter monitoring policy and waiting 48 hours for reports.
2. DMARC at p=none, real failures buried in the reports. The most common cause overall. The record exists, the policy is monitoring-only, the failures are silent. Migrate to p=quarantine then p=reject — the p=none Escape Plan walks the migration over 4 weeks with the DNS records at every step.
3. SPF missing or unaligned. SPF passes for the bounce address but the From header is a different organisational domain. DMARC sees the misalignment and fails. The SPF Checker confirms record presence; the DMARC Report Analyzer shows which specific senders are unaligned.
4. DKIM missing on a sender. Most DMARC failures we see in the wild are DKIM-unaligned. An ESP added last week was not enrolled with DKIM. Many ESPs publish DKIM via CNAME — the DKIM CNAME Validator walks the chain and verifies the terminal key.
5. Forwarding broke SPF. Mailing lists and aliases re-emit the message, breaking SPF on the new envelope. DMARC then needs DKIM alone — if DKIM is also broken or unaligned, DMARC fails. The ARC Chain Analyzer shows whether the forwarder preserved authentication state for downstream receivers.

Tools that pair with this one

• DMARC Report Analyzer — upload an aggregate (rua) XML file and see exactly which senders are failing alignment.
• Email Header Analyzer — paste the full headers from a failing message and see the SPF, DKIM, and DMARC results the receiver actually computed.
• DMARC Record Checker — deep inspection of every DMARC tag and what it means.

When the diagnoser cannot help

DNS scans cannot prove DKIM presence (no selector visible) and cannot show actual per-message authentication results. If your DMARC posture looks clean above but the rua reports still show failures, the cause is almost certainly a specific sender — the report analyzer is the next step. If the failures only happen when messages are forwarded, ARC is the diagnostic layer; if they only happen on outbound to Microsoft, the Microsoft 550 5.7.515 Diagnostic drills into Outlook-specific bulk-sender requirements.

Read the complete DMARC guide to learn more.