DIAGNOSTIC PLAYBOOK
DMARC reports show raw pass and policy failure
DMARC aggregate reports separate raw authentication results from policy-level aligned results. A mechanism can pass for an unrelated domain while the policy evaluation marks that mechanism as failing alignment.
HealthCheck Email editorial team · · Examples are illustrative
How to investigate
- Inspect the auth_results domains rather than reading only the pass labels.
- Compare them with header_from and the applicable alignment mode.
- Use the sending platform's domain-authentication settings to repair the mismatched identity, then observe later reports.
What this looks like
ILLUSTRATIVE EXAMPLE
The raw SPF section reports pass for a provider's bounce domain. The policy-evaluated SPF result is fail because that domain does not align with the visible sender.
A mistake to avoid
Do not sum raw pass counts as a DMARC success rate. Alignment is a separate condition that must be represented in the calculation.
Keep the result in context
DMARC connects the visible From domain to a passing, aligned SPF or DKIM identity. A DNS policy is an instruction to receivers, not a delivery receipt. Use message results and aggregate reports together, and identify legitimate services before tightening a policy.
Take the next step
Use the related check to gather evidence, then compare it with the affected message or service. Keep the result and time with your notes so a later change can be distinguished from the original problem.
Sources and further reading
The protocol references below explain the underlying behavior. Your sending or DNS provider supplies the account-specific settings for its service.