How do I troubleshoot DMARC failures and potential DKIM replay attacks affecting email deliverability?
Michael Ko
Co-founder & CEO, Suped
Published 11 Jul 2025
Updated 16 Aug 2025
7 min read
Email deliverability is a complex landscape, and encountering issues like DMARC failures or potential DKIM replay attacks can be frustrating. These problems can severely impact your ability to reach your recipients' inboxes, leading to missed opportunities and damaged sender reputation. Understanding the underlying causes and having a systematic approach to troubleshooting is crucial for maintaining healthy email sending practices.
When you see DMARC failures, it typically points to issues with how your emails are authenticated, specifically concerning SPF (Sender Policy Framework) and DKIM (DomainKeys Identified Mail). A DKIM replay attack, while distinct, can also manifest in DMARC reports, making it look like legitimate emails are being sent from unauthorized sources. This guide will walk you through diagnosing these issues and implementing effective solutions to safeguard your email program.
DMARC (Domain-based Message Authentication, Reporting, and Conformance) relies on SPF and DKIM to verify email authenticity. When DMARC fails, it means that an email claiming to be from your domain either didn't pass SPF or DKIM authentication, or it passed but failed DMARC alignment. This can lead to emails landing in spam folders or being rejected entirely, especially if you have a DMARC policy of quarantine or reject.
The most common reasons for DMARC failures stem from misconfigurations in your DNS records. An incorrect SPF record might not list all authorized sending IP addresses, causing legitimate emails to fail SPF authentication. Similarly, a misconfigured DKIM record or a problem with the digital signature can lead to DKIM authentication failures. These issues directly affect your domain's reputation with mailbox providers like Google and Yahoo, leading to reduced inbox placement.
Another factor is DMARC alignment. For DMARC to pass, the domain in the From header (the domain visible to the recipient) must align with the domain that passed SPF or DKIM. If these domains don't match or are not a subdomain of the original domain, even if SPF or DKIM technically pass, DMARC will fail. This is why DKIM from domain mismatch can be a significant issue.
Common DMARC misconfigurations
Incomplete SPF record: Not all legitimate sending services are included, causing SPF failures for some emails.
Incorrect DKIM setup: DKIM selectors are wrong, keys are expired, or the signature is corrupted.
Alignment issues: The 'From' header domain does not match the SPF or DKIM signing domain, even if authentication passes.
Forwarding problems: Email forwarding can break SPF and sometimes DKIM, leading to DMARC failures even for legitimate emails. This often appears as DMARC checks failing despite correct SPF and DKIM.
Distinguishing DKIM replay attacks from forwarding
A DKIM replay attack occurs when an attacker intercepts a legitimate email, extracts its valid DKIM signature, and then uses that signature to send forged emails that appear to originate from your domain. This is particularly insidious because the email will pass DKIM authentication, circumventing one layer of your email security. It can make it difficult to identify a compromised account.
While DKIM replay attacks are a concern, they are often confused with legitimate email forwarding. When an email is forwarded, its SPF authentication often breaks because the forwarding server's IP address isn't listed in the original SPF record. However, the DKIM signature typically remains intact, leading to a DMARC pass based on DKIM. This can result in DMARC reports showing a high volume of DKIM-passing emails that didn't originate from your known sending infrastructure.
Distinguishing between a true DKIM replay attack and legitimate forwarding is key. A replay attack will typically involve large volumes of unsolicited (spam) emails sent to new, often randomly generated, recipients, usually resulting in a surge in spam complaints or a higher spam rate in your Google Postmaster Tools. Legitimate forwarding, on the other hand, is usually less about malicious intent and more about how recipients manage their email. You can find more information about preventing DKIM replay attacks.
Legitimate email forwarding
SPF fails: When an email is forwarded, the forwarding server's IP often isn't authorized in the original SPF record.
DKIM passes: The DKIM signature, if not modified, usually remains valid.
DMARC passes via DKIM: DMARC relies on either SPF or DKIM passing with alignment, so DKIM pass is sufficient.
Expected behavior: Common for users who forward emails from one inbox to another, or due to mailing list re-injection.
DKIM replay attack
SPF fails: Attackers send from unauthorized IPs, causing SPF to fail.
DKIM passes: They use a legitimate, stolen DKIM signature, leading to a pass.
DMARC passes via DKIM: Similar to forwarding, the DKIM pass satisfies DMARC requirements.
Unexpected behavior: High volumes of suspicious mail from unlisted sources, often targeting arbitrary recipients, as noted in this article on replay attacks.
Analyzing DMARC reports and logs
To effectively troubleshoot DMARC failures and investigate potential DKIM replay attacks, your DMARC aggregate reports are invaluable. These XML reports, sent daily by participating mailbox providers, provide a comprehensive overview of your email traffic, showing how many messages passed or failed authentication for each sender and domain. Tools that process these reports can offer a clear visual representation of your email authentication status.
When reviewing your aggregate reports, pay close attention to the sources of emails that pass DKIM but fail SPF. If these sources are unfamiliar and represent a significant volume, it could indicate either a DKIM replay attack or unintended forwarding by a large number of recipients or mailing lists. Look for unexpected IPs or domains in the 'source IP' and 'sending domain' columns. You can learn how to diagnose DMARC failures using these reports.
Beyond DMARC reports, check your own sending logs. Look for any spikes in outgoing email volume that don't correspond to your planned campaigns or transactional sends. Investigate any unusual bounce messages, particularly those indicating a rate limit exceeded error, which could be a sign of an attacker rapidly sending emails through a compromised channel. Regularly monitoring your domain's reputation with tools like Google Postmaster Tools can also provide early warnings of reputation degradation.
Once you've identified the root cause of DMARC failures or potential replay attacks, it's time to implement solutions. For misconfigured DMARC, SPF, or DKIM records, the fix involves updating your DNS. Ensure your SPF record includes all legitimate sending IPs and that your DKIM records are correctly published with the right selectors. If you are experiencing trouble with Office 365 DKIM and SPF, there are specific steps to follow.
To mitigate DKIM replay attacks, one key strategy is to ensure your DKIM signature includes as many relevant headers as possible, such as Subject, From, To, Date, and Message-ID. Signing a broader set of headers makes it harder for attackers to alter the email content without invalidating the signature. Also, rotate your DKIM keys periodically to reduce the window of opportunity for attackers to exploit compromised keys. Implement DMARC with a p=quarantine or p=reject policy to instruct receiving servers on how to handle non-compliant emails.
Finally, continuous monitoring is non-negotiable. Regularly review your DMARC reports, and actively check for any suspicious activity or changes in your email deliverability metrics. Staying vigilant and promptly addressing any anomalies will help you maintain a strong sender reputation and ensure your emails consistently reach the inbox.
Stricter DKIM signing: Sign additional headers in your DKIM configuration to prevent manipulation.
Gradual DMARC policy enforcement: Start with p=none, then transition to quarantine, and finally reject once confident in your authentication setup.
Views from the trenches
Best practices
Regularly review your DMARC aggregate reports to quickly spot authentication issues or suspicious activity.
Ensure all your legitimate sending services are correctly authorized in your SPF record to prevent failures.
Implement a DMARC policy of p=quarantine or p=reject to protect your domain from spoofing.
Periodically rotate your DKIM keys to enhance security and minimize the risk of compromise.
Common pitfalls
Assuming DMARC failures are always attacks, when often they are due to legitimate forwarding or misconfigurations.
Not aligning SPF or DKIM with your email's 'From' header domain, causing DMARC to fail.
Ignoring DMARC reports, missing early signs of abuse or authentication problems.
Over-signing headers that change during legitimate forwarding, leading to false DKIM failures.
Expert tips
Use DMARC reports to distinguish between legitimate forwarding patterns and potential DKIM replay attacks.
Monitor your delivery logs and Postmaster Tools for sudden changes in email volume or spam rates.
Sign important headers like Subject, From, To, and Message-ID to strengthen your DKIM signatures.
Consider signing Cc headers if you believe they might be duplicated in abusive messages, but avoid Received or Resent-* headers.
Expert view
Expert from Email Geeks says that DMARC reports showing SPF failing but DKIM passing are normal in the case of email forwarding, as forwarding breaks SPF but not DKIM.
2022-05-09 - Email Geeks
Marketer view
Marketer from Email Geeks says that seeing a high volume of forwarded emails that pass DMARC, especially if it significantly outweighs non-forwarded mail, can be an indicator of a DKIM replay pattern.
2022-05-09 - Email Geeks
Ensuring email security and deliverability
Troubleshooting DMARC failures and addressing potential DKIM replay attacks are vital for maintaining email deliverability. By regularly analyzing your DMARC reports, verifying your DNS records, and implementing robust security measures, you can ensure your emails are authenticated correctly and protect your domain's reputation.
Remember that email security is an ongoing process. Stay informed about the latest threats and best practices to keep your email program secure and your messages consistently reaching their intended recipients.
Google and 
Yahoo, leading to reduced inbox placement.
