Skip to main content

Troubleshooting Guide: Resolving DMARC Validation Failures

Distributor troubleshooting for emails from Encompass bouncing or blocked by DMARC: check SPF/DKIM alignment, the From domain and DNS records on your domain. Requires v26.01+ and DNS admin access.

B
Written by Bailey Naas-Thornton

Minimum Version Required: 26.01

Pre-Conditions

  • Must have administrative access to the sender domain's DNS (Domain Name System) settings.

  • Requires access to email server delivery logs or bounced message headers.

  • Must be using an active internet connection to test email sending and run external validation tools.

Steps

  • Review the sender domain's DMARC policy to determine if it is explicitly set to reject or quarantine unaligned mail. If it is, legitimate emails failing alignment will be blocked.

  • Verify your email authentication checks; failures commonly occur when SPF (Sender Policy Framework) or DKIM (DomainKeys Identified Mail) alignment checks failed.

  • Confirm that the 'From' header domain cryptographically aligns with the signing domain.

  • Investigate the email transit path to ensure that the message body or header was not altered in transit, which breaks the cryptographic DKIM signature.

  • Check your DNS text records for DMARC to ensure they are configured correctly and are not experiencing propagation delays. If you recently updated settings, note that they can take up to 48 hours to update.

  • If the issue persists, please contact support and provide the following:

    • Exact error messages or codes encountered.

    • Screenshots or video recordings of the issue.

    • Log files (specifically original message headers and bounce message logs).

    • The exact steps taken by the customer that led to the issue.

    • The date and time the issue was first observed and any recurrence.

    • Any changes made to the system before the issue appeared.

Fields And Definitions

  • DMARC: A DNS setting (entirely controlled on the customer's side) that tells the email server what to do with stuff that is not DKIM verified.

  • DKIM (DomainKeys Identified Mail): A security key added to the DNS settings that tells all the other email servers in the world that it is okay for the system to send emails on behalf of that domain.

  • SPF (Sender Policy Framework): An email authentication protocol that allows domain owners to specify which mail servers are authorized to send email on behalf of their domain.

  • Alignment: The process of ensuring that the 'From' header domain cryptographically aligns with the signing domain (DKIM) or the Return-Path domain (SPF).

  • DNS Propagation Delay: The time required for DNS changes to be updated across internet servers worldwide.

Best Practices

  • Monitor Before Enforcing: When initially configuring DMARC, always start with a policy of p=none (monitoring mode) to review reports and ensure valid emails are passing alignment before moving to p=quarantine or p=reject.

  • Avoid In-Transit Modifications: Configure email gateways, anti-virus scanners, or automated signature tools to avoid altering the message body or headers after the email has been DKIM-signed, as this will break the cryptographic signature.

  • Keep DNS Clean: Regularly audit your DNS records to remove obsolete SPF and DKIM entries, ensuring that records remain correctly formatted and do not exceed DNS lookup limits.

Did this answer your question?