Email & SMTP · 1 min read
Email Authentication Errors: Fix SPF, DKIM and DMARC Issues
What's happening
Recipient servers rejected your email because your domain failed authentication. Typical bounce messages:
- "The sender's domain failed DMARC authentication"
- "Email rejected due to failed or missing SPF or DMARC authentication"
- "The sender's domain failed DKIM authentication"
- "The From header domain does not align with authenticated SPF or DKIM domains"
The three checks
- SPF lists the servers allowed to send for your domain.
- DKIM adds a digital signature that proves the message wasn't changed.
- DMARC tells receivers what to do when SPF or DKIM fail, and requires the From domain to align with them.
Fix it
- Use a domain you own. Free mailbox addresses (gmail.com, yahoo.com) can't pass DMARC when sent through another service. Send from your own domain.
- Add a dedicated sending domain. Go to Settings → Email Services → Dedicated Domain and add a subdomain such as mail.yourdomain.com. Add the DNS records shown and click Verify.
- Publish a DMARC record. Add a TXT record at
_dmarc.yourdomain.com, starting withv=DMARC1; p=none;. - Keep one SPF record. If you already have one, merge the new include into it rather than adding a second record.
- Re-test. Send a test email to a Gmail address, open Show original, and check that SPF, DKIM and DMARC say PASS.
Timeline
DNS changes usually take effect within a few hours but can take up to 48 hours. After authentication passes, delivery normally recovers within a few days.