Definition
Email authentication failure occurs when a receiving server evaluates a message against SPF, DKIM, or DMARC policies and determines the message cannot be verified as legitimate. These failures cause emails to be rejected outright, delivered to the spam folder, or quarantined depending on the sender's DMARC policy and the severity of the failure. Understanding the specific type of authentication failure is the first step toward resolving it.
SPF alignment failures happen when the envelope sender domain, the domain in the Return-Path header, does not match the domain the recipient sees in the From address. This commonly occurs when using a third-party email service provider that sends from its own domain in the envelope but your domain in the From header. SPF checks the envelope domain's authorised sending servers, so if the envelope domain is not authorised to send for your From domain, the SPF check fails alignment. The fix requires either configuring your ESP to use your domain in the envelope sender or setting up email forwarding that preserves SPF alignment.
DKIM signature failures occur when the receiving server cannot validate the cryptographic signature attached to the email. This often happens when messages are forwarded or passed through mailing lists that modify the email content. Any modification to the email body or critical headers invalidates the DKIM signature. DKIM signing during forwarding is a known challenge, and solutions include using ARC (Authenticated Received Chain) to preserve authentication results across forwarding hops.
Best Practices
- Diagnose authentication failures using email analysis tools: Use tools like MXToolbox, Mail-Tester, or Google Postmaster Tools to analyse exactly which authentication check is failing. These tools provide detailed breakdowns of SPF, DKIM, and DMARC evaluation and suggest specific configuration changes.
- Fix SPF alignment by configuring your ESP as an authorised sender: Add your ESP's sending IPs to your SPF record and configure a custom return-path or envelope sender using your domain. This ensures the envelope domain matches your From domain, passing SPF alignment.
- Prevent DKIM failures during forwarding with ARC: Implement ARC (Authenticated Received Chain) to preserve authentication results when email is forwarded through mailing lists or forwarding services. ARC adds a chain of authentication results that receiving servers can trust even when the original DKIM signature is invalidated.
- Set a monitoring DMARC policy before moving to enforcement: Start with a DMARC policy of
p=noneto collect visibility data about authentication failures without impacting delivery. Analyse the reports for 4-8 weeks, resolve all identified failures, then progress top=quarantineand eventuallyp=reject. - Monitor authentication failure rates weekly with alerts: Track the percentage of emails failing SPF, DKIM, or DMARC checks. Set alerts for when failure rates exceed 2% for any authentication method. Early detection of authentication issues prevents gradual reputation damage that accumulates over weeks.
Related Glossary Terms
BIMI
BIMI (Brand Indicators for Message Identification) is an email standard that allows brands to display their logo next to their emails in supported email clients. It requires DMARC enforcement at quarantine or reject policy.
Bounce Classification
Bounce classification uses SMTP codes (550, 551, 552, 553, 554, 450, 451, 452) and enhanced status codes to categorise permanent and transient delivery failures.
DMARC Alignment
DMARC identifier alignment determines whether the domain in the From header matches the domains used in SPF and DKIM authentication. Strict or relaxed.
Email Active Subscriber
An active email subscriber has opened or clicked an email within a defined recency period, typically 30-90 days by industry. Active subscriber rate of 40-60% is typical for healthy email lists.
Email Authentication Header
Authentication-Results email headers that show SPF, DKIM, and DMARC verification outcomes for deliverability diagnostics.
Email Blacklist
An email blacklist (DNSBL) is a real-time database of IP addresses or domains known for sending spam or unwanted email.
Frequently Asked Questions
SPF alignment fails when the domain in the `Return-Path` header differs from the domain in the `From` header, or when the specified SPF record does not include the sending server's IP address. Common causes include using a third-party ESP without configuring custom return-path, incorrect SPF record syntax, and exceeding the 10-lookup DNS limit for SPF records.
First, verify your DKIM key is correctly published in DNS using a DKIM lookup tool. Ensure your ESP is configured to sign emails with the correct selector and private key. If the failure occurs after forwarding, implement ARC to preserve authentication across forwarding hops. If the failure is intermittent, check that your DNS TTL is not caching a stale DKIM record after key rotation.
The receiving server follows the DMARC policy published in your DNS record. If your policy is `p=none`, the message is delivered normally but the failure is recorded in DMARC aggregate reports. If `p=quarantine`, the message goes to spam. If `p=reject`, the message is bounced and never reaches the recipient. Gmail and Yahoo enforce DMARC strictly, especially for bulk senders.
Each ISP weights authentication factors differently in their spam filtering algorithms. Gmail treats DMARC alignment as critical and will reject or spam messages that fail DMARC, especially since their 2024 bulk sender requirements. Microsoft 365 is generally more lenient with SPF alignment failures if DKIM passes. Smaller ISPs may not check DMARC at all. Understanding each ISP's behaviour helps prioritise which authentication issues to fix first.
Send a test email to a diagnostic service such as Mail-Tester, MXToolbox, or GlockApps. These services check your SPF, DKIM, and DMARC configuration and provide detailed pass or fail results for each check. For ongoing monitoring, use DMARC aggregate report analysers that show authentication pass or fail data across all receiving domains for your actual campaign traffic.