Over the past couple of weeks, we've had about five legitimate messages from different companies rejected because they failed DMARC verification. In roughly 20 years of handling email, I've only encountered this once or twice before. Our own SPF, DKIM, and DMARC configuration appears healthy, and these senders are valid customers or clients. Their domains are using a strict DMARC policy of p=reject, so messages fail outright when their SPF or DKIM authentication breaks. Has anyone else noticed an increase like this, or is there a broader change in how major email providers handle DMARC failures?
4 Answers
I’ve seen similar behavior with hosted email systems and security gateways. Large providers have become less tolerant of unauthenticated or misaligned mail, and stricter filtering can expose configuration problems at vendors that used to go unnoticed. The practical fix is usually to contact the affected sender’s IT team and give them the exact SPF, DKIM, and DMARC failure details.
This can happen as more domain owners move from DMARC monitoring with p=none to enforcement policies such as p=quarantine or p=reject. A message that previously arrived despite an SPF or DKIM problem will now be quarantined or refused, depending on the recipient system and the sender’s policy.
The failures are probably on the senders’ side rather than yours. Common causes include an outdated SPF include, a sender exceeding SPF’s 10-DNS-lookup limit, missing DKIM signing, DNS problems, or a third-party service sending mail without proper domain alignment. DMARC passes when either aligned SPF or aligned DKIM passes; both do not necessarily need to pass.
Check the authentication details and DMARC aggregate or forensic reports instead of relying only on the rejection notice. They can show which sending IP or DKIM selector failed and whether the problem was authentication, alignment, DNS resolution, or policy enforcement. Aggregate reports are especially useful for spotting recurring issues across vendors.
The overall failure rate in one set of reporting data stayed below one percent and did not show a dramatic industry-wide spike, so the increase may be specific to the senders reaching your organization or to stricter enforcement by the systems involved.
That matches what we’re seeing. One legitimate sender had several messages arrive normally, then another message five minutes later failed because their authentication suddenly broke. We even saw a major travel company fail DMARC temporarily before correcting its configuration.