Fix SPF, DKIM, and DMARC Failures Together

Authentication issues are usually linked. If SPF fails, DKIM is missing, and DMARC warns at the same time, treat them as one sender-identity problem instead of three separate bugs.

Start with the From domain

  • Confirm the visible From domain is the domain you actually intend to authenticate.
  • Check whether the return-path domain belongs to the same organization.
  • Make sure your ESP or SMTP relay is allowed to send for that domain.

Fix SPF first

  1. Publish one SPF TXT record at the envelope-from domain.
  2. Merge duplicate SPF records into a single v=spf1 string.
  3. Remove outdated providers so you stay under the 10-lookup limit.

Then fix DKIM

  1. Enable DKIM signing in the provider you are sending from.
  2. Publish the selector records exactly as provided.
  3. Send a fresh message and verify the report shows dkim=pass.

Finish with DMARC

  1. Publish _dmarc.yourdomain.com as TXT.
  2. Start with p=none while validating traffic.
  3. Add reporting addresses so you can see alignment problems before tightening policy.

Common failure patterns

  • SPF passes but DMARC still fails: the return-path domain is not aligned with the visible From domain.
  • DKIM exists but fails: the selector record is wrong, missing, or cached.
  • Everything fails at once: the message is being sent from a different provider than the DNS records were built for.

What to resend after changes

  • One plain-text message from the same provider that failed before.
  • The exact From domain you plan to use in production.
  • No forwarding or aliasing during the test.

Deliverlens report reading order

  1. SPF result
  2. DKIM result
  3. DMARC result
  4. Received chain and HELO or PTR warnings

If the three core authentication checks all pass, move on to content, links, and reputation. Until then, those secondary issues are not the real bottleneck.