What happens at p=reject if a service is not aligned?

13 May 2026 · The DMARC Engine Team · 1 min read

When your DMARC policy is p=reject, any message that fails DMARC is rejected by the receiving mail server before it reaches the inbox. With p=quarantine it lands in spam instead. A message fails DMARC when it is not aligned, meaning it passes neither an aligned SPF check nor an aligned DKIM signature for your domain.

Why an unaligned sender fails

DMARC (see RFC 7489) requires alignment, not just a pass. A third-party service that sends on your behalf, a CRM, helpdesk, invoicing tool or marketing platform, fails alignment if:

• its SPF pass authenticates a different Return-Path domain, and
• it does not add a DKIM signature using your domain's selector.

Get either one aligned and the message passes. If neither aligns, at p=reject that mail is rejected outright.

How staged rollout catches this first

This is exactly why we never switch a domain straight to reject. DMARC Engine stages your policy none → quarantine → reject over a few weeks. At p=none nothing is blocked, receivers simply send back RUA aggregate reports telling us every source sending as your domain and whether each one is aligned.

We ingest and read those reports for you, so unaligned legitimate services surface and get fixed before the policy can reject anything. The result is enforcement with no email outage.

How to fix an unaligned service

• Align via DKIM (preferred): add the service's DKIM public key at selector._domainkey.yourdomain and enable signing in the tool. DKIM alignment survives forwarding.
• Align via SPF: set a custom Return-Path / bounce domain on your domain so the SPF-authenticated domain matches, and include the sender in your SPF record (mind the 10-lookup limit).

See how we enforce and the requirements, or start your setup.