Said It Here

Why am I getting DMARC and SPF errors when emails deliver fine?

Third-party email marketing services often fail basic SPF checks within DMARC reports because their sending IPs are not included in your domain's DNS records, even though inbox providers still manage to deliver the messages. This discrepancy leaves administrators guessing about real deliverability health and creates confusing tool warnings that hinder proper configuration.

What people tried

Every workaround mentioned in the threads below. We haven’t tested any of them — and nobody here is claiming they worked.

  1. 1
    Adding a subdomain as suggested by email marketing providers
  2. 2
    Relying on DKIM alignment to pass DMARC overall despite SPF alignment failure
  3. 3
    Using personal email accounts to contact external vendors, donors, and providers
  4. 4
    Scaling back email security and encryption tools
  5. 5
    Running domain diagnostics through tools like MX Toolbox, Unspam, and Google Postmaster Tools
  6. 6
    Restarting the computer
  7. 7
    Changing the AntiPhish policy to quarantine messages instead of rejecting them
  8. 8
    Setting up DMARC reporting in-house or with a service
  9. 9
    Checking SPF, DKIM, and DNS records

In their words

Unedited, most upvoted first, each linked to the thread it came from.

We experienced this recently and it came down to a DNS issue.source ↗

prolongedexistence · r/nonprofit · 11 upvotes

I'm having trouble setting up SPF for my domain. I use email marketing services, but I keep getting SPF errors when sending emails.source ↗

I'm not sure which service this IP is from. It's a Google IP address, but I don't know how to properly configure SPF for all the services I usesource ↗

Meanwhile, Postmaster shows zero SPF-pass statistics – which is strange – 99% of emails arrive without any issues, even though we send a lot of emails.source ↗

Андрей Черненко · Server Fault · 10 upvotes

Recently, many of our org's emails to providers, donors, and vendors have been blocked or rejected :/source ↗

As a result, some staff have been using their personal email with external contacts to complete time-sensitive work, which is not ideal.source ↗

Usagi_0522 · r/nonprofit · 10 upvotes

Anyone experiencing IMAP connectivity issues to outlook? Getting this Logging in is disabled on this server: "A protocol-level access (such as IMAP or legacy authentication) has been turned off for your mailbox on the server side, or your account's credentials/license require an administrator fix" Randomly started happening, nothing changed.source ↗

BadassNobito · r/sysadmin · 9 upvotes

In the last couple of weeks, we've had several emails getting come in with failed DMARC verification and get rejected.source ↗

In the past 2 weeks we've had 5 separate instances all from different companies.source ↗

lordwarg · r/sysadmin · 9 upvotes

Luckily, they told us we're not blacklisted, but in just doing a quick run through MX Toolbox, there's a slew of dmarc, spf, dns, mx, and smptp errors popping upsource ↗

Usagi_0522 · r/nonprofit · 6 upvotes

Outlook wasn’t behaving for me this morning… quick restart of pc and all resolved.source ↗

theballygickmongerer · r/sysadmin · 1 upvotes

Exchange Online? We started noticing the same recently and had to change the AntiPhish Default policy to quarantine messages instead of rejecting them.source ↗

ObjectNo9529 · r/sysadmin · 1 upvotes

Where this came up

People with this problem also raised