Troubleshooting guide
DMARC Fail: What It Means and How to Fix It
DMARC fail means neither SPF nor DKIM passed for a domain matching your From address, so the receiver applied your policy. Below: every common DMARC error, from “policy not enabled” to 554 5.7.5, with the exact fix.
Your message to [email protected] couldn't be delivered.
Remote server returned:
554 5.7.5 Permanent error evaluating
DMARC policy_dmarc.northwind.io · TXT
v=DMARC1; p=none; rua=mailto:[email protected]
v=DMARC1; p=quarantine
v=DMARC1; p=quarantine; rua=mailto:[email protected]
Fix: two records found → merged into one ✓
Basics
What DMARC fail means
A DMARC fail is a verdict, not a single error. The receiver checks whether SPF or DKIM passed for a domain that lines up with the From address your recipient sees. If neither did, it looks up your policy and acts on it.
How a receiver evaluates DMARC
One aligned pass is enough. Your policy only applies when both checks fail.
In May 2026 the IETF moved DMARC onto the standards track as RFC 9989, replacing RFC 7489. Existing records keep working because the version tag is still v=DMARC1. The main change for senders: the pct tag was removed, and a new t=y test flag tells receivers to apply one step softer than your published policy. New to the three records? Start with SPF vs DKIM vs DMARC.
Error messages
DMARC failure errors, decoded
Find the line from your bounce or checker below. Codes are from Google's Gmail error reference and Microsoft's documentation.
| Error or warning | What it means | How to fix it |
|---|---|---|
554 5.7.5 Permanent error evaluating DMARC policy | The receiver couldn't get a valid policy: two _dmarc records, a typo such as p=rejct, or no v=DMARC1 at the start. | Keep one TXT record at _dmarc with valid syntax. Under the current standard, duplicate records are all ignored. |
550 5.7.26 Unauthenticated email from [domain] is not accepted due to domain's DMARC policy | Gmail: SPF and DKIM both failed alignment and your policy is reject. | Find the service that sent it and sign it with DKIM on your domain. |
550 5.7.40 … sending domain doesn't have a DMARC record … | Gmail: you send in bulk and have no valid DMARC record. A 421 4.7.40 variant rate-limits instead of blocking. | Publish a DMARC record (p=none is enough to comply). |
550 5.7.515 Access denied, sending domain … does not meet the required authentication level | Outlook.com: 5,000+ messages to Microsoft consumer inboxes without SPF + DKIM passing and an aligned DMARC pass. | Publish all three records and make SPF or DKIM align with your From domain. |
550 5.7.1 | Microsoft 365: the header shows dmarc=fail action=oreject because your p=reject was applied. | Fix alignment at the source; the receiver is doing what your policy asks. |
| DMARC policy not enabled | A DNS checker warning: your record uses p=none. | Not urgent. Tighten to quarantine, then reject, using the rollout below. |
| No DMARC record found | Nothing is published at _dmarc.yourdomain.com. | Add the starter record below. |
About 554 5.7.5: it isn't listed in Google's or Microsoft's public error references, and the wording varies by receiving server. In practice it points at a DMARC record the receiver couldn't parse. Microsoft's documentation pairs the matching dmarc=permerror header result with the same fix: correct the syntax and make sure only one _dmarc TXT record exists.
Fix it
Check your DMARC record, then fix the failure
Run your domain through the checker. It reads your live _dmarc record and tests SPF, DKIM and MX alongside it.
Checks SPF, DKIM, DMARC and MX records live. Free, no sign-up.
Or check from a terminal
dig TXT _dmarc.northwind.io +short
"v=DMARC1; p=none; rua=mailto:[email protected]"Step 1
Read the headers
Open the bounced or spam-foldered message and find the Authentication-Results line.
Step 2
Check the record
Exactly one TXT record at _dmarc, starting v=DMARC1, with a valid p= value.
Step 3
Fix alignment
Sign with DKIM on your domain, or give SPF a return-path on your domain.
Step 4
Resend and verify
Send a test to Gmail and look for dmarc=pass in Show original.
Starter record (TXT, host: _dmarc)
v=DMARC1; p=none; rua=mailto:[email protected]Alignment
Why DMARC fails even when SPF and DKIM pass
DNS authentication can pass for the wrong domain. DMARC only counts SPF or DKIM results whose domain matches your From domain; by default a subdomain of the same domain also counts.
Authentication-Results header showing an alignment failure
spf=pass smtp.mailfrom=bounces.mailer-example.net
dkim=pass header.d=mailer-example.net
dmarc=fail header.from=northwind.io| From address | SPF or DKIM domain | Relaxed (default) | Strict (aspf=s / adkim=s) |
|---|---|---|---|
| [email protected] | northwind.io | Aligned | Aligned |
| [email protected] | mail.northwind.io | Aligned | Not aligned |
| [email protected] | mailer-example.net | Not aligned | Not aligned |
The fix is almost always DKIM: have the sending service sign with d= your domain. DKIM also survives forwarding, which SPF doesn't. Our DKIM setup guide covers Google Workspace and Microsoft 365.
Mailboxes that pass DMARC from the first email
Policy not enabled
Moving from p=none to quarantine and reject
“DMARC quarantine/reject policy not enabled” goes away once your policy enforces. Tighten it in steps and read your aggregate reports between each one, as Microsoft recommends.
Step 1
Monitor
p=none with a rua address. Find every service that sends as you.
Step 2
Fix senders
Get each legitimate source passing SPF or DKIM in alignment.
Step 3
Quarantine
p=quarantine. Failing mail goes to spam; keep reading reports.
Step 4
Reject
p=reject. Spoofed mail is refused outright.
Final record
v=DMARC1; p=reject; rua=mailto:[email protected]Ramping with pct?
pct tag, so receivers that follow the new standard ignore it. To test a stricter policy, add t=y: receivers then treat reject as quarantine and quarantine as none while you watch reports.Build the record with the DMARC generator, and check the rest of your setup in the email deliverability guide.
Sources: RFC 9989 (DMARC) · Gmail SMTP error codes · Google email sender guidelines · Microsoft: set up DMARC · Microsoft: fix 550 5.7.515 · Yahoo sender best practices · MXToolbox: DMARC Policy Not Enabled
Get a free DMARC audit
Tell us where to send it. We'll reply with mailbox, domain and DNS recommendations for your sending volume — or start right away and have mailboxes live in minutes.
Where should we send it?
Or see pricing →Frequently asked questions
What does DMARC fail mean?
A message fails DMARC when neither SPF nor DKIM passes for a domain that matches (aligns with) the domain in the visible From address. The receiver then applies the policy in your DMARC record: deliver anyway (p=none), send to spam (p=quarantine) or refuse the message (p=reject).
How do I fix "554 5.7.5 Permanent error evaluating DMARC policy"?
This bounce means the receiving server could not get a usable DMARC policy for your domain. The usual causes are two TXT records at _dmarc, a typo in the p= value, or a record that does not start with v=DMARC1. Keep exactly one record, fix the syntax, check it with dig, then resend.
What does "DMARC quarantine/reject policy not enabled" mean?
It is a warning from DNS checkers such as MXToolbox, not a delivery error. Your domain has a DMARC record, but its policy is p=none, so spoofed mail is still delivered. Move to p=quarantine and then p=reject once your aggregate reports show every legitimate sender passing.
What does "No DMARC record found" mean?
There is no TXT record at _dmarc.yourdomain.com. Gmail and Outlook.com require one from anyone sending more than 5,000 messages a day to their users, and Yahoo requires one from all bulk senders. Publish v=DMARC1; p=none; rua=mailto:[email protected] to start, then tighten the policy.
Why does DMARC fail when SPF and DKIM both pass?
Because DMARC also needs alignment. If a sending service uses its own bounce domain for SPF and signs DKIM with its own domain, both checks pass for that service's domain, not yours. Set up DKIM signing with your own domain at the service, or a custom return-path on your domain.
Can email forwarding cause DMARC failures?
Yes. A forwarding server sends from its own IP address, so SPF fails. DKIM usually survives unless the forwarder changes the message, for example by adding a footer. Some failures from mailing lists and forwarders in your reports are normal.