Troubleshooting | DMARC Engine

30 July 2026 · 37 min read

Troubleshooting DMARC Failure Due to Overly Restrictive SPF Records

Overly restrictive SPF records can cause DMARC failure, affecting email deliverability, learn how to troubleshoot and fix the issue

27 July 2026 · 37 min read

Mitigating False Positives in DMARC Reporting

False positives in DMARC reporting can lead to legitimate emails being rejected, damaging email deliverability. Optimising DMARC records is key to prevention

26 July 2026 · 47 min read

Troubleshooting DMARC Alignment Issues with Load Balancers and CDN Providers

Load balancers can complicate DMARC alignment, learn how to configure them correctly to improve email deliverability. DMARC Engine experts share their experience

22 July 2026 · 44 min read

Troubleshooting DMARC Alignment Issues with Third-Party Senders

Achieving DMARC alignment with third-party senders is crucial for email authenticity, but often proves challenging, requiring careful configuration of SPF and DKIM records

21 July 2026 · 39 min read

DMARC and Email Client Configuration

DMARC prevents email spoofing, learn how to configure email clients like Mozilla Thunderbird and Microsoft Outlook for optimal security. Understand the basics of DMARC and its importance in email security

12 June 2026 · 12 min read

SPF PermError: when your SPF silently stops working

SPF breaks quietly. Cross the 10 DNS-lookup limit and your record returns PermError, fails open, and stops protecting your domain. Here is how to count, fix and flatten it safely.

29 May 2026 · 13 min read

Why DMARC fails when SPF and DKIM pass

SPF passes, DKIM passes, yet DMARC still fails on legitimate mail. The cause is almost always alignment: both checks authenticated a domain other than the one in your From header. Here is how to find the misaligned identifier in a single message header and across all sources in your aggregate reports, then fix each cause.

28 May 2026 · 10 min read

DMARC says quarantine but mail still reaches the inbox

A quarantine policy does not always mean the spam folder. Here is why failing mail still lands in the inbox: pct sampling, alignment, receiver discretion, DNS caching, and exactly what to check.

27 May 2026 · 11 min read

How to fix SPF PermError

SPF PermError means a receiver tried to evaluate your SPF record and gave up, so SPF stops counting towards DMARC. This guide diagnoses PermError, TempError and the ten-lookup limit, then walks through a step by step repair process.

26 May 2026 · 13 min read

DMARC reports show sources I do not recognise

Unknown sending IPs in your DMARC aggregate reports are normal, not an emergency. Here is a reliable four-question triage to tell shadow IT and forwarders from real spoofers, and exactly what to do with each.

17 May 2026 · 11 min read

The SPF 10-lookup limit, explained

SPF caps how much DNS work a receiver may do when evaluating your record. Go over the 10-lookup limit, or the separate void-lookup limit, and SPF returns a permerror that quietly stops helping your DMARC result. Here is how includes consume the budget, why exceeding it breaks SPF, and how to get safely back under the line.

20 April 2026 · 12 min read

Fix: BIMI logo not showing in Gmail

Gmail shows a grey initial instead of your BIMI logo and never says why. Here is every reason it fails, in the order Gmail checks them: DMARC not at enforcement, a missing VMC, an SVG that breaks the Tiny PS profile, a logo-to-certificate mismatch, and cached negative results, plus how to fix each.

19 April 2026 · 12 min read

Fix: DKIM fails after forwarding

Forwarders and mailing lists break DKIM by changing the message body and headers, not the connection. Here is exactly what fails, what survives, where ARC helps, how to spot forwarding failures in your DMARC reports, and how to reduce the impact without parking at p=none.

18 April 2026 · 13 min read

Fix: DKIM public key not found in DNS

The "DKIM public key not found in DNS" error is almost always a naming or publishing problem, not a broken key. Here is exactly which name receivers query, why it returns nothing, how CNAME and TXT publishing differ, and how to confirm the key resolves end to end.

17 April 2026 · 13 min read

Fix: DKIM signature did not verify

"DKIM signature did not verify" is at least six different problems wearing one error string: body hash mismatch, no key in DNS, malformed record, key mismatch after rotation, expired signature, or a key too short. Here is how to read the exact reason in the brackets and apply the one correct fix for each.

16 April 2026 · 13 min read

Fix: MTA-STS policy not found

"MTA-STS policy not found" is never one problem: it is a five-link chain (DNS TXT, HTTPS host, certificate, file path, file content) plus the MX-coverage trap, and it fails silently because senders fall back to opportunistic TLS rather than bounce. Walk the discovery the way a sending MTA does, with real dig, curl and openssl checks, and fix the first broken link.

15 April 2026 · 11 min read

Fix: multiple DMARC records

Two TXT records at _dmarc do not make DMARC stricter; they switch it off entirely, silently. Here is why RFC 7489 mandates that, the exact ways duplicates sneak into a zone, how to detect them and how to consolidate down to one correct record without losing your settings.

14 April 2026 · 11 min read

Fix: multiple SPF records

Two SPF records on one domain force a permanent PermError that silently strips a DMARC route. Here is why it happens, how receivers treat it, and how to merge two records into one compliant record without losing a sender or blowing the 10-lookup limit.

13 April 2026 · 11 min read

Fix: SPF TempError

An SPF TempError is a transient DNS failure, not a broken record. Here is what it means, why it differs from PermError, how Google, Yahoo and Microsoft treat it under SPF and DMARC, and the concrete steps that make your SPF resolution reliable.

12 April 2026 · 12 min read

Fix: SPF too many DNS lookups

SPF caps you at ten DNS-querying mechanisms, counted after every include expands into its provider's nested netblocks, which is why a record with five includes can spend fifteen lookups and PermError. Here is how to count the budget, prune the includes that overspend it, and flatten or consolidate back under the limit before enforcement makes the failure bite.