DMARC pass and fail, explained

Updated 2026-08-03 · Troubleshooting

You're looking at a dashboard full of verdicts — pass, fail · p=none, mixed, would reject — and you need to know, precisely, what each one is claiming about your mail. This article decodes them. (Its companion, DMARC alignment explained, teaches why the rules work this way; this one is for when you're staring at results and want them translated.)

The one rule that decides pass

A message passes DMARC when at least one of these is true:

• SPF passed, and the domain it passed for aligns with the visible From domain, or
• DKIM verified, and the signing domain aligns with the visible From domain.

One aligned pass is enough — you never need both. Every verdict you will ever see is downstream of that single rule.

The corollary trips everyone once: a check can pass and still count for nothing. SPF that passes for your email provider's bounce domain, or a DKIM signature from the provider's own domain rather than yours, is a real pass for an unaligned domain — and an unaligned pass contributes exactly as much to DMARC as a fail.

The ways a message fails

Three distinct situations all end in the same word, and telling them apart is most of the diagnostic skill:

The first two rows are your mail with unfinished homework: the sender is legitimate and the fix is completing its aligned setup, usually the provider's custom-domain DKIM. The last row is the one DMARC exists to catch — no aligned identity, no raw authentication, nothing vouching for the message at all.

That is the shape of a failure; for the underlying causes, roughly ranked by how often they turn up in reports, and the fix for each, see Common causes of DMARC failure.

How the verdicts appear in DMARCmetric

The Sending sources table shows results at two levels, and the labels are worth reading precisely.

Per-source rows (expand any provider group) carry three verdicts. The SPF and DKIM columns show alignment results — ✓ aligned or ✕ fail — not raw authentication, so an unaligned pass displays as ✕ fail, which is exactly how DMARC counts it. The final DMARC column gives the source's overall verdict:

• pass — at least one check aligned. This source is done.
• fail · p=none — nothing aligned; the mail is delivered only because a monitoring policy is in effect.
• would reject — the source is a threat: it failed both SPF and DKIM. The label is a simulation — under p=reject this mail would be refused, whatever your current policy says.

Group rows roll their sources up into one pill:

Two details of the rollup matter. A group goes mixed when some of its sources align and some don't — expanding it shows exactly which stream needs attention. And the threat check comes first: a single threat turns its whole group would reject, whatever its neighbours are doing — one bad source can't hide behind passing ones. The mechanics of the grouping itself are covered in Sending sources, grouped by provider.

Reading verdicts in practice

Three rows you will actually meet, decoded — note that two of them carry the same label and mean opposite things:

• Google — pass. Aligned on at least one check across every source. Whatever SPF is doing underneath (forwarded rows often fail it), aligned DKIM is carrying the mail. Nothing to do.
• Mailchimp — would reject. Expand it: one source shows ✓ aligned DKIM and passes; another shows ✕ fail on both columns — a threat, so the whole group is flagged, even though the "threat" is your own marketing team's second audience, connected without the domain-authentication step. To DMARC, a fully unauthenticated legitimate stream is indistinguishable from spoofing — which is exactly why it must be fixed before you enforce. The failing row's From domain and IP tell you which stream.
• Unknown — would reject, a country you've never sold to. Both columns ✕ fail, modest probing volume. Spoofing: nothing to configure, because it was never yours — your policy is the fix.

Same label, opposite remedies: one would reject you repair, the other your policy blocks. The From domain, country and volume pattern are how you tell them apart.

One habit ties it together: judge sources, not messages. A single failing message might be a forwarder; a source that fails consistently is either your unfinished setup or someone else's forgery, and the columns tell you which. Where these verdicts sit in the bigger picture — KPIs, trends and the compliance ring — is mapped in Understanding your dashboard, and you can practise reading all four pills on realistic data in the live demo.