Summary
DMARC failures stemming from third-party senders like OpenAir, particularly due to a lack of DKIM signing or SPF alignment issues, are a common challenge for organizations. When OpenAir's SPF authenticates on its domain (openair.com) instead of the client's domain, and DKIM signatures are absent, DMARC alignment fails. This is critical, especially for businesses requiring a p=reject DMARC policy. The primary resolution involves configuring OpenAir to correctly sign emails with the client's domain via DKIM or ensuring SPF alignment. Often, this requires direct engagement with the third-party vendor's support team, as public documentation may be scarce or outdated. For a comprehensive understanding of DMARC and its components, see our simple guide to DMARC, SPF, and DKIM.
Key findings
- Lack of DKIM signing: DMARC failures with OpenAir often stem from the absence of DKIM signatures on outbound emails, preventing domain alignment.
- SPF authentication vs. alignment: While SPF may authenticate on openair.com, DMARC requires SPF to align with the 5322.From (header from) domain, which is typically the client's domain. This misalignment leads to DMARC failing, even if SPF passes.
- Outdated documentation: Finding current and helpful support documentation for DKIM setup specifically for Netsuite or OpenAir can be challenging, with much information being outdated or requiring specific access.
- Sensitive industries: Clients in industries like finance often require a strict p=reject DMARC policy, making correct DKIM alignment even more critical for deliverability and preventing spoofing. For more on DMARC policies, read our guide on how to safely transition your DMARC policy.
Key considerations
- Engage vendor support: If self-service documentation is insufficient, directly contacting OpenAir or Netsuite's technical support team is often necessary to obtain the public DKIM TXT record and ensure proper activation from their end.
- DKIM signing by sender: The ideal solution is for OpenAir to sign emails with your client's domain using DKIM. This ensures DMARC alignment and improved deliverability. See Kinsta's advice on how to fix DMARC failures.
- DMARC policy adjustments (temporary): As a temporary workaround, or if the vendor cannot support custom DKIM signing, consider changing the 5322.From (header from) to a subdomain with a p=none DMARC policy, though this is not a long-term solution for strict compliance.
- Continuous monitoring: Regularly monitor DMARC reports to identify any ongoing authentication or alignment issues, especially when working with third-party sending services.
What email marketers say
Email marketers frequently encounter DMARC failures when using third-party systems like OpenAir because these platforms often send emails on behalf of the client's domain without proper DKIM signing. The core issue revolves around DMARC's requirement for alignment between the visible 'From' address (header from) and the authenticated domain. Marketers emphasize the distinction between SPF authentication (which might pass on the sending service's domain) and SPF alignment, which demands a match with the client's domain. When this alignment is missing, especially coupled with a lack of DKIM, DMARC will fail. Many marketers find that older documentation from vendors like Oracle Eloqua or Netsuite (OpenAir's parent company) often points to additional, sometimes costly, branding or deliverability packages required to enable custom DKIM signing. This highlights a common struggle for marketers to maintain strong email authentication when relying on external platforms. For further troubleshooting, consider our guide on how to troubleshoot DMARC failures.
Key opinions
- Vendor limitations: Many third-party ESPs, including some enterprise platforms, do not automatically support DKIM signing with the client's domain, leading to common DMARC failure points.
- Costly features: Historically, and sometimes currently, features like custom DKIM signing for domain alignment are offered as part of premium or additional 'deliverability' packages by large software vendors.
- Alignment is key: It's crucial to understand that DMARC validates not just authentication (SPF/DKIM pass) but also alignment, meaning the authenticated domain must match the email's From header domain. For more on this, check out eSecurity Planet's article on getting DMARC right.
- Subdomain workaround: A temporary solution some marketers employ is to use a subdomain for sending and set a p=none DMARC policy on that subdomain, reducing the deliverability impact on the main domain.
Key considerations
- Prioritize direct vendor engagement: Marketers should first try to work directly with their third-party sending platform's support to enable proper DKIM signing and SPF alignment for their domain.
- Review authentication status: Regularly check DMARC reports to identify if SPF and DKIM are passing and, more importantly, aligning with your sending domain.
- Understand DMARC policy impact: Be aware that a p=reject policy will cause unauthenticated or misaligned emails to be bounced, potentially leading to lost communications. Learn more about DMARC tags and their meanings.
- Explore alternatives: If a third-party vendor cannot meet DMARC alignment needs for a p=reject policy, marketers may need to explore alternative sending solutions or adjust their email strategy for that specific platform.
Marketer view
Email marketer from Email Geeks explains that DMARC failures often occur when SPF authenticates on the sending service's domain (like openair.com) but doesn't align with the actual 'From' domain in the email header. This distinction is crucial for DMARC to pass.
Marketer view
Email marketer from DuoCircle's article highlights that SPF and DKIM records must be correctly set up and align with your domain to prevent DMARC failures, ensuring all authorized sending services are included.
What the experts say
Deliverability experts consistently highlight that DMARC failures, especially with third-party senders, are almost always a symptom of alignment issues rather than outright SPF or DKIM authentication failures. They underscore that while a service like OpenAir might correctly authenticate its own domain via SPF (openair.com), DMARC requires that the domain used for authentication aligns with the visible 'From' domain of the email. Without this alignment, or a valid DKIM signature that also aligns, DMARC will fail. Experts frequently advise that direct communication with the third-party vendor's technical support is the most effective route to resolve these issues, as it often requires specific configuration changes on their end that are not publicly documented or user-configurable. Understanding why DMARC authentication fails when SPF and DKIM pass is a critical first step.
Key opinions
- Alignment is paramount: DMARC's effectiveness hinges on the alignment of the domain in the 5322.From header with either the SPF-authenticated domain or the DKIM-signed domain.
- DKIM is often missing: For many third-party sending services, the primary issue is the lack of DKIM signing by the client's domain, leading to DMARC failure even if SPF passes on the service's domain.
- Direct vendor contact: When DMARC failures persist with a third-party sender, the most efficient solution is almost always to contact their technical support directly, as custom DKIM keys need to be provided and activated by them.
- DMARC policy implications: For domains with a p=reject policy, any DMARC failure due to misalignment or missing DKIM means emails will not be delivered, which is especially critical for sensitive communications. You can learn more about best practices for implementing DKIM, SPF, and DMARC.
Key considerations
- Verify SPF and DKIM setup: Before contacting support, ensure your own SPF and DKIM records for your domain are correctly published and configured, as this can sometimes be a contributing factor. Our guide on how to verify DMARC, DKIM, and SPF setup can help.
- Request PTR records: When troubleshooting, providing the PTR (Pointer Record) of outgoing server IPs (e.g., relay.openair.com) can help experts perform general lookups and guide next steps.
- Address invalid DKIM: If DMARC reports show DKIM as 'invalid' or 'fail', it indicates the sending service is either not signing emails, or the keys are misconfigured, requiring their intervention. DuoCircle offers a piece on causes and solutions of DMARC failures.
- Long-term solution: Aim for the vendor to provide a public DKIM TXT record that you can publish, and ensure they activate DKIM signing for your domain on their platform for full DMARC compliance.
Expert view
Deliverability expert from Email Geeks reiterates that SPF authenticating on one domain (e.g., openair.com) and DMARC failing due to lack of alignment means the return-path and header 'From' domains do not match, a common source of DMARC issues.
Expert view
Deliverability expert from SpamResource explains that DMARC requires either SPF or DKIM to pass AND align with the 'From:' header domain. If a third-party service only passes SPF for its own domain, DMARC will fail unless DKIM is also configured for the client's domain.
What the documentation says
Official documentation from email authentication standards and major vendors provides foundational insights into DMARC, SPF, and DKIM. These resources consistently emphasize that DMARC is built upon the successful authentication and, crucially, the alignment of either SPF or DKIM with the email's header from domain. For third-party sending services like OpenAir, the documentation often states that the responsibility for ensuring this alignment, particularly through custom DKIM keys, lies with the customer or requires specific branding or deliverability packages. The critical takeaway is that merely having an SPF record that authenticates the sending IP is insufficient for DMARC if it does not align, and a valid, aligned DKIM signature becomes indispensable in such scenarios. Delve deeper into DMARC mechanics with this advanced guide to email authentication.
Key findings
- DMARC specification: RFC 7489 (DMARC) mandates that for an email to pass DMARC, either the SPF-authenticated domain or the DKIM-signed domain must align with the RFC5322.From header.
- DKIM's role in alignment: When SPF alignment is not possible with a third-party sender (e.g., due to different return-path domains), DKIM signing by the client's domain is the primary method to achieve DMARC compliance.
- Vendor-specific configuration: Oracle NetSuite (parent of OpenAir) documentation often indicates that configuring advanced email authentication like DKIM requires specific settings within their platform, sometimes tied to broader branding or deliverability service packages. Refer to Oracle's Eloqua Email Authentication help.
- Email flow implications: When a third-party service sends emails without proper DKIM signing from the customer's domain, the email's authentication chain breaks, leading to DMARC failures and potential quarantining or rejection by recipient servers.
Key considerations
- Consult official documentation: Always refer to the most up-to-date vendor-specific documentation (e.g., Oracle Netsuite's guides) for precise instructions on configuring DKIM and SPF within their platform, as configurations can change.
- Understand DMARC report data: DMARC aggregate reports provide critical data on authentication and alignment results, allowing administrators to pinpoint sources of failures and track compliance over time. For more information, see our guide on how to interpret DMARC reports.
- Secure specific access: Be prepared that some comprehensive documentation or configuration settings may reside behind a login portal, requiring appropriate client access or vendor support engagement. Oracle's Netsuite guides, for instance, sometimes link to internal help articles, like this one on DMARC and email domains.
- Evaluate third-party capabilities: Before selecting a third-party email sender, verify their capabilities for custom domain DKIM signing and full DMARC compliance, especially if a strict DMARC policy is required.
Technical article
Documentation from Oracle states that proper email authentication for Eloqua (related to Netsuite/OpenAir) often requires a 'Branding and Deliverability' package to ensure email branding alignment and improve deliverability through features like custom DKIM.
Technical article
Documentation from RFC 7489 (DMARC) specifies that an email passes DMARC if either the SPF check passes and aligns with the organizational domain of the 'From' header, or the DKIM signature passes and aligns with the organizational domain of the 'From' header.
Related resources
4 resources
Related pages
Why does DMARC authentication fail when SPF and DKIM pass, and how can it be fixed?
How to verify DMARC, DKIM, and SPF setup?
How to set up DMARC, DKIM, and SPF for emails from a web server and manage bounce responses?
Why do my emails go to spam due to DMARC, SPF, and DKIM alignment failures?
Why your emails are getting a 'DMARC verification failed' error
How to fix common DMARC issues in Microsoft 365 and Google Workspace
Decoding DKIM temperror: what it is and how to fix it
Why your emails fail: expert guide to improve email deliverability [2025]
A simple guide to DMARC, SPF, and DKIM
How to troubleshoot DMARC failures and their impact on email deliverability?
