Separate authentication from policy and alignment
SPF, DKIM and DMARC address related but different questions. SPF evaluates whether an SMTP client is authorized to send using a domain in the envelope sender or HELO identity. DKIM verifies a cryptographic signature over selected message headers and body content. DMARC then evaluates whether SPF or DKIM passes and aligns with the domain shown in the visible From header, applying a published policy when appropriate.
A message can pass SPF and still fail DMARC when the authenticated SPF identity is not aligned with the visible From domain. Similarly, a technically valid DKIM signature may not align with the visible From identity. Do not equate a single green authentication-result field with successful DMARC.
Inspect DNS publications and failure modes
Typical DNS records include a TXT value at the sending domain for SPF and a TXT value at _dmarc.example.com for DMARC. A minimal illustrative record set might look like this:
example.com. TXT "v=spf1 include:_spf.example.net -all"
_dmarc.example.com. TXT "v=DMARC1; p=none; rua=mailto:[email protected]"Only deploy an include when you know the external sender's published SPF domain and have authorization to use it. SPF evaluation is subject to a limit of ten DNS-lookup mechanisms/modifiers, including relevant recursive evaluations; manually counting mechanisms in a pasted string is only a preliminary check. Avoid duplicate SPF policy records for one domain.
The DMARC p=none policy requests monitoring rather than enforcement. Moves toward quarantine or reject should follow analysis of legitimate email sources and alignments, not a guess based on one test. Verify where aggregate reports are sent and whether the reporting mailbox can process them.
Diagnose an actual failed message
Inspect the receiving system's Authentication-Results header, preserving a sanitized copy for investigation. Record the SMTP envelope sender, visible From address, DKIM d= domain, DKIM selector, the receiver's SPF result, and DMARC verdict. Then identify whether the failure reflects DNS publication, forwarding behavior, alignment, signing, message modification, or temporary DNS faults.
For DKIM, verify that the selector record exists under selector._domainkey.example.com and that the sender applies a signature using the correct key. A forwarding service can change the effective SPF client without necessarily breaking DKIM; mailing list modifications may affect signed content.
Validate before enforcing
Start with inventory: primary mail provider, ticketing systems, transaction processors, contact form and other legitimate senders. Use staged changes, collect aggregate reports, and test mail received by independent providers. Keep credentials, individual mailbox contents and full headers containing private addresses out of public analyzers.
The JoeC SPF / DMARC Analyzer checks pasted text, not live DNS, nested SPF includes, message signatures or delivery. Treat it as syntax assistance only.