What this symptom usually tells you
DMARC fails when the visible From domain is not aligned with a passing SPF identity and is also not aligned with a passing DKIM signing domain. A message can therefore show “SPF pass” for a vendor bounce domain yet still fail DMARC because the domains are not aligned.
Evidence that narrows the cause
Use the live diagnostic to test the exact hostname involved. For this problem, the highest-value evidence is below. Treat each result as one piece of the business-email DNS and mail authentication diagnosis rather than as a standalone health score.
- Inspect Authentication-Results — Verify inspect Authentication-Results from the public Internet and compare it with the value the responsible provider says should be live.
- Check From domain alignment — Verify check From domain alignment from the public Internet and compare it with the value the responsible provider says should be live.
- Fix SPF or DKIM path — Inspect the single public v=spf1 policy, validate its terms and count DNS-query-causing mechanisms; duplicate policies or excessive lookups can invalidate SPF.
Record the current state before editing
Before changing business-email DNS and mail authentication settings, save the exact public values for inspect Authentication-Results, check From domain alignment, fix SPF or DKIM path and note which hostname or mail path is failing. This creates a rollback point and prevents a later resolver cache, provider dashboard or unrelated working record from being mistaken for the original cause. Change one evidence-backed setting at a time, then compare the same signals again.
Safest repair path
Inspect Authentication-Results and the message’s From, Return-Path and DKIM d= values. Fix the path that should provide alignment: configure a custom return path for aligned SPF, configure DKIM signing with the organizational domain, or correct a broken DKIM key/signature.
How to confirm this specific repair
Send a new message through the affected service and confirm DMARC=pass in the received headers. The result should be explained by at least one aligned passing mechanism, not merely by the presence of SPF/DKIM DNS records.
A common wrong turn
Do not troubleshoot DMARC only by looking at the _dmarc TXT record. A perfectly valid policy can still report failures because DMARC is evaluated against message-level authentication and alignment.
When to escalate with evidence
If these public checks match the provider's current documented configuration but the service still fails, give support the exact hostname, the observed business-email DNS and mail authentication result, a timestamp, and the failing network or message path. That separates a provider-side incident from a DNS change that has not actually become authoritative.
Technical references
These primary standards and provider documents are used to verify the behavior described on this page. Provider dashboards can change, so use the current official value for tenant-specific DNS records rather than copying an example from another account.