Over the past couple of weeks, we've seen several legitimate messages rejected because DMARC verification failed. In roughly 20 years of handling email, I've only encountered this once or twice before, but recently there have been five separate incidents involving different companies. Our own SPF, DKIM, and DMARC configuration appears healthy, and these senders are valid customers or clients. The failed messages show that the sending domain has a strict DMARC policy such as p=reject. Has anyone else noticed an increase like this, and is there a broader change in how major mail providers handle SPF, DKIM, or DMARC failures?
4 Answers
Legitimate senders can fail DMARC when a provider’s sending IP is missing from SPF, an SPF record exceeds the ten-DNS-lookup limit, DKIM signing breaks, or the authenticated domain doesn’t align with the visible From domain. Temporary DNS or provider-side issues can also cause intermittent failures. Expedia-like incidents can happen even when the sender usually works correctly.
Mail providers have generally become stricter about unauthenticated or misaligned mail, especially for high-volume senders. That can make existing configuration mistakes more visible, but it doesn’t prove there was one specific industry-wide switch. The important distinction is whether your users are rejecting inbound mail or your outbound messages are being rejected by others.
The best way to investigate is to examine the rejection details and your DMARC aggregate or forensic reports. They should identify the sending IP, SPF and DKIM results, alignment status, and policy applied. If the failures are from known partners, send their technical team the evidence so they can correct their DNS or mail-service configuration.
A likely explanation is that more domain owners are moving from DMARC monitoring with p=none to enforcement policies such as p=quarantine or p=reject. Once a sender publishes p=reject, any message that fails DMARC can be refused by the recipient. That doesn’t necessarily mean your configuration is wrong; the sending organization may have an SPF, DKIM, DNS, or alignment problem.
In our case, our users are receiving nondeliverables for inbound messages from the other organizations. Their domains are the ones failing SPF or DKIM, and they have p=reject published. We’ve also seen one sender succeed and then fail a few minutes later, so intermittent provider or DNS issues seem possible.