Why are some SFMC emails failing DKIM and causing DMARC rejections?
Michael Ko
Co-founder & CEO, Suped
Published 15 Jul 2025
Updated 18 Aug 2025
7 min read
Email deliverability can be a complex challenge, especially when dealing with advanced sending platforms like Salesforce Marketing Cloud (SFMC). We often encounter situations where emails, despite originating from legitimate sources and seemingly having proper authentication, fail to reach their intended inboxes.
A particular headache arises when a small percentage of SFMC emails begin bouncing consistently due to DMARC (Domain-based Message Authentication, Reporting, and Conformance) rejections. This issue typically surfaces when a receiving ISP reports that certain emails are failing DKIM (DomainKeys Identified Mail) authentication, and because SPF (Sender Policy Framework) is not aligning, the DMARC policy kicks in, leading to rejections.
It’s perplexing when major ISPs like Gmail, Yahoo, and Microsoft process the emails fine, while smaller providers like Comcast, SBCGlobal, and Bellsouth experience consistent bounces. This points to specific issues within the email sending process, often related to how DKIM is applied by the sending platform.
To grasp why SFMC emails might fail DKIM and trigger DMARC rejections, it’s essential to understand the interplay of email authentication protocols. DKIM provides a way to verify that an email was indeed sent by the domain it claims to be from and that it hasn't been tampered with in transit. It does this by adding a digital signature to the email header.
DMARC then builds upon SPF and DKIM, requiring that at least one of these authentication methods pass and, crucially, align with the From: header domain. If both SPF and DKIM fail alignment or authentication, DMARC instructs the receiving server on how to handle the email, which can include quarantining or rejecting it. For a deeper dive into SPF and DKIM alignment, you can refer to Salesforce's documentation on alignment issues.
When a small fraction of emails are not signed by DKIM at all, this is a red flag. It suggests that SFMC might not be consistently applying the DKIM signature across all outbound messages. This could be due to various reasons, such as specific sending configurations, load balancing across different IP pools, or even a rare, intermittent bug within the platform.
Important: DMARC policy deployment
You shouldn't deploy a DMARC policy to p=reject if you don't have full control over your mailstreams to ensure proper SPF or DKIM alignment. Starting with a p=noneDMARC policy is a safer initial step to gather insights without impacting deliverability.
Common causes of DKIM failure in SFMC
The core of the problem often lies in the failure of DKIM signatures for a subset of emails. This can happen if SFMC's signing process is intermittent or if certain emails are routed through a different path that bypasses DKIM signing. For example, if you have multiple IP pools or sending domains configured, one might be misconfigured while others work correctly.
Another possibility is that the emails are being modified after leaving SFMC but before reaching the recipient. While less common for bulk sends directly from an ESP, intermediaries, firewalls, or even certain email security solutions could potentially alter headers or content in a way that invalidates the DKIM signature. However, this is usually detectable through DMARC reports.
The fact that Gmail, Yahoo, and Microsoft are not seeing these issues suggests their DMARC validation processes might be more lenient or forgiving, or they simply have better internal whitelisting for SFMC IPs. Alternatively, these larger providers might have different processing mechanisms that prevent the DKIM signature from being stripped or corrupted. The difference in DMARC implementation among receivers is a known factor in deliverability.
Typical DKIM setup
Consistent signing: All emails sent via SFMC should be consistently signed with the correct DKIM key, ensuring authentication.
Aligned domains: The domain used in the DKIM signature should align with the From: header domain for DMARC to pass.
Proper DNS records: DKIM public keys must be correctly published in DNS as TXT records.
Observed issues in SFMC
Missing signatures: A small percentage of emails are not signed by DKIM at all, leading to authentication failures.
SPF misalignment: Even if SPF passes, it may not align with the From: domain, leaving only DKIM for DMARC pass.
ISP variations: Smaller ISPs (e.g., Comcast) reject emails, while larger ones (e.g., Outlook) accept them, indicating different DMARC enforcement levels.
The impact of DMARC policies and troubleshooting
A crucial step in diagnosing these issues is to analyze your DMARC reports. These reports provide invaluable insights into email authentication results, showing which emails are passing or failing SPF and DKIM, and, critically, why. While direct access to these reports might be challenging for some users, they are the primary source of truth for understanding DMARC failures and how to troubleshoot DMARC issues.
If a small percentage of emails consistently fail DKIM, your DMARC reports should highlight this. They'll show the source IPs, the sending domains, and the authentication results, helping you pinpoint whether these problematic emails originate from specific IP pools within SFMC or are related to certain campaign types. This is essential for isolating the root cause and formulating a solution.
Changing your DMARC policy from p=reject to p=none or p=quarantine is a temporary workaround, but it doesn't solve the underlying DKIM issue. It merely prevents rejections by telling receiving servers to monitor or junk the emails instead of outright blocking them. The goal should be to fix the DKIM failures, not just mask them.
Resolving SFMC-specific issues
If your DMARC reports indicate that a small percentage of SFMC emails are consistently failing DKIM, the most direct course of action is to engage with Salesforce Marketing Cloud support (or your specific ESP). This behavior is not standard and suggests an internal issue on their end. Provide them with specific details, including bounce messages, the percentage of failures, and the affected ISPs (Comcast, SBCGlobal, etc.).
It’s plausible there's a configuration discrepancy or a rare bug within their platform that affects specific sending environments or IP pools. We've seen instances where certain IP allocations or internal routing mechanisms within an ESP can lead to inconsistent authentication. If your client has multiple IPs and only a subset are sending unauthenticated email, this strongly points to a platform-side issue. You can also refer to Google's email sender guidelines for general best practices that often apply to all sending platforms.
Ultimately, while the overall deliverability might still be high (e.g., 99%+), the 6-7% soft bounces at specific domains highlight a problem that impacts a segment of your audience. Rectifying these DKIM failures is crucial for maintaining optimal deliverability and domain reputation, especially as ISPs continue to tighten their email authentication requirements. Continued DMARC rejections, even if small, can negatively impact your sender reputation over time and potentially lead to your domain being placed on a blacklist or blocklist.
Resolving DKIM and DMARC failures
Check DMARC reports: Gain access to and regularly review your DMARC aggregate reports to identify authentication failures, source IPs, and affected receivers.
Contact SFMC support: Provide detailed evidence of missing DKIM signatures for specific email percentages and bounce messages.
Audit sending configuration: Work with SFMC to confirm all sending IP pools and domains are correctly configured for DKIM signing and SPF alignment.
Consider temporary DMARC policy adjustment: If the issue persists, consider changing your DMARC policy to p=quarantine while troubleshooting, to reduce rejections without completely removing DMARC protection. You can learn how to safely transition your policy.
Views from the trenches
Best practices
Always ensure your email sending platform's DKIM setup is fully verified and consistent across all sending IPs or domains.
Regularly monitor DMARC aggregate reports to catch any authentication anomalies or failures early on.
Maintain consistent SPF and DKIM alignment for all outbound mail to ensure DMARC passes effectively.
If using multiple IP pools or sending configurations, verify each is correctly authenticated to prevent inconsistencies.
Common pitfalls
Deploying a DMARC policy of p=reject before fully verifying all legitimate email streams are properly authenticated and aligned.
Ignoring small percentages of DMARC failures, as they can escalate into larger deliverability issues and impact domain reputation.
Not having access to DMARC reports or failing to analyze them effectively to diagnose the root causes of authentication failures.
Assuming major ISPs' acceptance of emails means smaller ISPs will behave similarly, ignoring varied DMARC enforcement.
Expert tips
Leverage DMARC forensic reports (RUA/RUF) to get more granular data on specific authentication failures, though RUF reports are less common.
Conduct targeted email deliverability tests to the affected ISPs (e.g., Comcast, SBCGlobal) to isolate the issue more precisely.
Verify the email's header integrity from SFMC sends for any signs of modification or incorrect signing post-dispatch.
If SFMC support is unresponsive, consider involving a third-party email deliverability consultant to help diagnose and advocate for a fix.
Expert view
Expert from Email Geeks says: You should not be at p=reject if you lack control over your mailstreams for domain alignment. If DKIM were aligned, the issues would likely be resolved. What information do your DMARC reports provide about these issues?
2020-01-29 - Email Geeks
Expert view
Expert from Email Geeks says: A DKIM signature should be aligned, and the fact that it is not signed for a small percentage of emails is concerning. Changing the DMARC policy to p=none or aligning SPF would be a workaround, but the core question is why DKIM would fail or be missing for some emails but not all.
2020-01-29 - Email Geeks
Ensuring email authentication for seamless delivery
When SFMC emails fail DKIM and trigger DMARC rejections, it’s a clear indication that authentication is not consistently applied across all sends. This can stem from configuration issues within the sending platform, particularly if a small subset of IPs or campaigns exhibit this behavior. While large mailbox providers might be more forgiving, smaller ISPs often enforce DMARC more strictly, leading to bounces.
The key to resolving these issues lies in a combination of thorough DMARC report analysis and proactive engagement with your Email Service Provider. By identifying the exact circumstances under which DKIM fails, you can work towards a permanent solution that ensures all your legitimate emails are properly authenticated, safeguarding your sender reputation and optimizing your email deliverability.
Gmail, 
Yahoo, and 
Microsoft process the emails fine, while smaller providers like Comcast, SBCGlobal, and Bellsouth experience consistent bounces. This points to specific issues within the email sending process, often related to how DKIM is applied by the sending platform.
Outlook) accept them, indicating different DMARC enforcement levels.
