Emails with DMARC: 'FAIL' even though it passes from the https://mxtoolbox.com validator

Question

I am using [email protected] below for privacy, but this is happening to a real domain and email address.

In the mass emails that we send, DMARC is failing:

In my TXT records, this is what I have for DMARC:

_dmarc 14400 IN TXT "v=DMARC1; p=none; rua=mailto:[email protected]; sp=none; aspf=r"

When I go to validate my DMARC records at https://mxtoolbox.com, this is what I get:

Why could DMARC be failing even when a validator says that it passes, no syntax error and everything looks right? Notice how SPF and DKIM are passing. The problem is only with DMARC for some reason that I am trying to understand.

UPDATE 1: I found this paragraph at https://support.google.com/a/answer/2466563?hl=en:

Alignment mode refers to the precision with which sender records are compared to SPF and DKIM signatures, with the two possible values being relaxed or strict. represented by "r" and "s" respectively. In short, relaxed allows partial matches, such as subdomains of a given domain, while strict requires an exact match.

Notice in my _dmarc 14400 IN TXT "v=DMARC1; p=none; rua=mailto:[email protected]; sp=none; aspf=r" how I am trying to use the relaxed mode.

Answer 1

I'd guess (because I can't tell from what you've posted) it's because your SPF sender domain is not "aligned" with your From header. You're sending through sendgrid, so I expect that sendgrid is also handling your bounces, so you probably have a return-path header on a received message something like:

Return-path: <[email protected]>

But your From header is in your own domain:

From: <[email protected]>

your SPF may give permission to send from sendgrid's IPs (via include of their SPF record), so you'll get a pass for that, but clearly example.net and sendgrid.net are not the same domain, so they are not considered aligned and you'll get a DMARC failure.

For it to align in aspf=s more, either your from address would need to be a sendgrid.net address (probably not what you want), or your mail server needs to be at example.net (you're probably using sendgrid because you don't want to be running your own mail server), so you'd need to revert to aspf=r (relaxed) mode. This would allow you to create a CNAME in your DNS that points a name in your domain, such as mail.example.net at sendgrid's mail server, and they would need to know that arrangement is in place so that they can send messages using that envelope sender, and in relaxed mode, example.net and mail.example.net are considered aligned and you'll get a DMARC PASS.

mxtoolbox will be giving you a pass because your DMARC record is indeed perfectly valid when considered in isolation, but unless your domains on sent messages actually align, it still won't work.

Answer 2

An addendum to the accepted answer, specifically for Sendgrid:

If you have everything set up correctly in your main user account, that does not mean that a subuser account is able to send and have DMARC pass. You have to assign the verified domain to the subuser.

I had verified my domain and also set up a dedicated IP address and configured reverse DNS. The IP address was correctly assigned to the subuser. I thought the domain verification was also working for the subuser, because SPF and DKIM passed. But it turned out that they passed with sender domain sendgrid.com, not with my custom domain. So that's why DMARC failed.

Sendgrid offers the option to assign a verified domain to a subuser when you first set up the verified domain (it's an "advanced" option; documentation here). If the domain is already verified, there doesn't seem to be a way to assign it to a subuser from the Sender Authentication tab.

On the other hand, there does seem to be a place in the Subuser Management tab. If you edit a particular subuser, there's a "Change Sending" button; after you click that, you can choose a domain. I haven't tried it this way, but it looks like it should work. It's not mentioned in the documentation linked above.

I think it is also possible to verify a domain when logged in as the subuser, but I also haven't tried this.

I don't know if you need aspf=r or adkim=r in your DMARC record for this to work. I have them just in case, but it looks to me like the DKIM sender domain is my custom domain, not a subdomain, so I think that would be good enough.

Answer 3

Simply add a txt record in your DNS settings using the subdomain _dmarc

"v=DMARC1\;p=none\;pct=100\;rua=mailto:[email protected]\;ruf=mailto:[email protected]"

Note: Remove other _dmarc records

To test you have the proper structure you can check with

$ dig +short txt _dmarc.mydomain.com 

should return

"v=DMARC1\;p=none\;pct=100\;rua=mailto:[email protected]\;ruf=mailto:[email protected]"