DMARC fail means that neither of your two identity checks, SPF and DKIM, both passed and matched the domain in your From address. One matched pass is enough to clear DMARC, so a fail tells you both are broken or both point at the wrong domain. The fix, in nearly every case for someone sending from Google Workspace, is to turn on DKIM for your domain first, then check SPF, then publish a gentle DMARC policy.
If you've already set the three records up once and still see a fail, this article is for you. It assumes the records exist and walks through finding which part is broken. For the first-time setup, use our SPF, DKIM and DMARC guide.
What a DMARC fail looks like, in a bounce and in a header
You'll meet it in one of two places. The first is a bounce with a code like 550 5.7.26 and wording such as "unauthenticated email from your-domain is not accepted due to the domain's DMARC policy." Google's SMTP error reference uses that wording for 5.7.26. The second is a header on a test message that reads "dmarc=fail." The bounce means a receiving server enforced your policy and refused the mail. The header on its own, with delivery still working, means your policy is set to monitor only and nothing has been refused yet. Both are the same underlying fault.
Which check failed: read the Authentication-Results line
Send a message from the affected address to a free Gmail account you own. Open it, click the three dots and choose Show original. A box at the top lists SPF, DKIM and DMARC with PASS or FAIL. Scroll to the header called Authentication-Results for the detail. It looks like this, abbreviated:
spf=softfail smtp.mailfrom=cassengraving.example
dkim=none
dmarc=fail (p=REJECT) header.from=cassengraving.example
Read it as three questions. Did SPF pass, and for which domain? Did DKIM pass, and which domain signed it (look for header.d)? Did DMARC accept the combination? Here SPF failed softly (a record exists, but it doesn't list the server that sent the mail), DKIM was missing, and so DMARC had nothing to accept.
Alignment, without the jargon
DMARC doesn't just ask whether SPF or DKIM passed. It asks whether the domain they checked is the same as the domain in your visible From address. If you send as cass@cassengraving.example and DKIM was signed by a mail service's own domain, DKIM passed but doesn't match, so DMARC counts it as a fail. That match is called alignment. Google's setup page describes the pass condition as SPF with SPF alignment, or DKIM with DKIM alignment, at least one of the two. In relaxed mode, which is the default, a subdomain such as mail.cassengraving.example counts as matching the main domain.
| What the header shows | What it means | Fix |
|---|---|---|
| dkim=none | Your domain isn't signing mail | Turn on DKIM for the domain |
| dkim=pass but header.d is another domain | A service signs with its own domain; not aligned | Set up custom-domain signing in that service |
| spf=fail or softfail | The sending server isn't in your SPF record | Add Google (and any other sender) to SPF |
| spf=none | No SPF record at all | Publish one |
| spf=pass, dkim=pass, dmarc=fail | Both pass, neither matches the From domain | Fix alignment on one of them |
The order to fix things in
Cass sells engraved trophies and plaques to schools. She moved to Google Workspace on her own domain and copied a DMARC record with p=reject from a template, without turning on DKIM or adding Google to her SPF record first. Of her first 40 emails, six bounced with 5.7.26. Her fix order, which works for most people:
- Turn on DKIM for the domain in the Google Workspace admin console (Gmail, then Authenticate email). DKIM survives forwarding, SPF doesn't, so it's the check that holds up best. About 15 minutes plus DNS waiting.
- Check SPF. For Google, the record includes Google's servers. If you also send through another service, it needs its own entry. Keep it to one SPF record.
- Publish or relax DMARC. Set the policy to none for now and add an address for reports.
- Re-test with a message to yourself (next section).
- Leave it alone for two weeks before tightening anything.
Changing the order costs you: a strict DMARC policy before DKIM and SPF are in place is exactly how Cass bounced her own mail.
Re-test with a message to yourself
Send a new message, not a forward of the old one, to your own Gmail address. Show original again. You want PASS on all three. If DKIM still shows none, the DNS record hasn't propagated yet or you didn't click the start-authentication button in the admin console after publishing it. DNS can take hours. Try again later in the day before changing anything else. Cass got three PASS lines the next morning, and her next batch of 30 went out without a single 5.7.26.
When a tool other than Gmail is the cause
If you send a newsletter, an invoice system or a CRM that mails as your domain, each of those is a separate sender. Any of them that isn't covered by your SPF record or doesn't sign with your domain will show up as a fail, even while your Gmail is perfect. The signs: Gmail's own test passes, but a particular tool's messages fail. Fix it in that tool's settings, usually by publishing a record it gives you. The question of using your main domain for outreach at all is covered in can you send cold email from your main domain.
A policy you can live with
Google recommends starting with a policy of none, watching the reports, then moving to quarantine and later reject as you learn which of your senders authenticate. For a small outreach sender, quarantine is a reasonable stopping point. The upside of reject is protecting your domain from being forged. The downside is that one forgotten tool silently stops delivering. If you're unsure whether the fail is yours or a recipient's rule, your message has been blocked in Gmail separates them, and if everything passes but you still land in spam, how to check if your domain is blacklisted is the next stop. The wider picture is in deliverability basics.
Authentication is the sort of setup you do once and want to forget. Rocketship finds the buyers, emails them from your own Gmail, follows up, and books the meeting on its own, using the Google account you've already set up. Plans that get you customers start at $24.99 a month (Launch), and every monthly plan starts with a 7-day free trial, card required. See how the AI workers run outreach.