Summary
When emails sent via Salesforce Marketing Cloud (SFMC) experience DKIM failures and subsequent DMARC rejections, it indicates a critical issue in your email authentication setup. This scenario typically leads to significant deliverability problems, especially with ISPs that enforce strict DMARC policies. Understanding the root causes of these failures, particularly when they affect only a small percentage of sends or specific IP pools, is essential for maintaining your sender reputation and inbox placement. These issues often point to misconfigurations within the ESP's sending infrastructure or specific message content that interferes with the signing process.
Key findings
- Partial DKIM failures: A small percentage of emails failing DKIM signatures from SFMC suggests an intermittent issue, rather than a complete misconfiguration. This can be harder to diagnose than consistent failures.
- DMARC rejection without SPF alignment: When DKIM fails or is missing and SPF is not aligned, a DMARC policy of p=reject will cause emails to bounce. For more details, see our guide on DMARC verification failures.
- ISP-specific issues: Problems occurring specifically with ISPs like Comcast, SBCGlobal, and Bellsouth indicate these receivers have stricter authentication checks.
- Impact of unauthenticated IPs: Emails sent from specific IP pools within an ESP's network might lack proper authentication, leading to DMARC failure.
Key considerations
- Review DMARC reports: Aggregated DMARC reports (RUA) provide insights into authentication failures, including DKIM and SPF. These reports show where and why DMARC is failing. Kinsta offers more on fixing DMARC failures.
- Engage with ESP support: If only a fraction of emails are unsigned, this suggests a potential bug or misconfiguration on the ESP's side. SFMC support should be able to investigate the cause.
- Consider DMARC policy adjustment: If consistent authentication issues persist, consider lowering your DMARC policy to p=none or p=quarantine until the underlying DKIM issues are resolved. Learn more about safely transitioning your DMARC policy.
- Investigate message characteristics: Look for distinctive features in emails failing DKIM. This could involve RFC 821 violations, encoding problems, or specific content types that interfere with signature generation.
What email marketers say
Email marketers often face challenges with DMARC and DKIM failures, particularly when sending through third-party platforms like SFMC. Their experiences highlight the difficulty in diagnosing intermittent issues and the critical role of DMARC reports in uncovering the root causes. Marketers frequently point to the need for close collaboration with their ESPs and caution against aggressive DMARC policies before achieving full authentication alignment.
Key opinions
- DMARC policy caution: Many marketers advise against setting a DMARC policy to p=reject if full domain alignment for SPF and DKIM isn't consistently achieved.
- ESP responsibility: There's a strong sentiment that if an ESP is used, they should ensure proper authentication and advise clients against policies that could lead to deliverability issues.
- Intermittent DKIM issues: Some marketers have observed very small percentages of emails from SFMC going out without DKIM, suggesting a rare platform bug. See why your emails fail and how to fix them.
- IP pool discrepancies: Issues might be confined to specific IP pools used by the ESP, indicating a segmented problem within their infrastructure.
Key considerations
- Monitoring DMARC reports: Accessing and analyzing DMARC reports is crucial for identifying the extent and nature of authentication failures. Without these, troubleshooting is significantly hindered.
- SPF alignment: If DKIM isn't consistently signing, ensuring SPF alignment becomes even more critical to pass DMARC. Learn more about SPF alignment failures.
- Cost-benefit analysis: For very small percentages of failing emails, some marketers may decide the effort to fix outweighs the deliverability impact.
- Proactive ESP communication: Regular discussions with ESPs about authentication practices and DMARC policy recommendations are essential.
Marketer view
Marketer from Email Geeks observed DMARC bounces at specific ISPs. They noted a small fraction of emails failing DKIM authentication, leading to rejections when SPF was not aligned. This inconsistency in DKIM signing was the core of their issue, despite their DMARC policy being set to reject.
Marketer view
Marketer from Email Geeks suggests that marketers should not implement a DMARC policy of p=reject if they cannot ensure consistent domain alignment. They indicate that proper DKIM alignment would likely resolve many DMARC issues.
What the experts say
Email deliverability experts emphasize the technical nuances behind DKIM and DMARC failures, especially when dealing with large-scale sending platforms. Their insights often focus on the critical interplay between authentication mechanisms and DMARC policy enforcement. They stress the importance of understanding underlying mailstream behavior, potential encoding issues, and the responsibilities of email service providers (ESPs) in maintaining proper email authentication.
Key opinions
- Gradual DMARC deployment: Experts strongly advise against moving to a p=reject DMARC policy without robust control and visibility over all mailstreams to ensure SPF and DKIM alignment.
- Deep technical investigation: When DKIM issues are sporadic, experts suggest investigating specifics like RFC 821 violations, email encoding issues, and patterns across recipient domains.
- ESP accountability: Experts believe it's the ESP's responsibility to manage authentication correctly. If an ESP doesn't advise clients on proper DMARC deployment, it may signal a lack of attention to deliverability best practices.
- Complexity of intermittent issues: Small percentages of unexplained authentication failures, especially from large ESPs like SFMC, can be indicative of underlying system bugs that are challenging to diagnose.
Key considerations
- DMARC report analysis: Leveraging DMARC reports is paramount for experts to diagnose authentication failures. These reports provide the necessary data points to troubleshoot complex issues. For more information, see our page on troubleshooting DMARC failures.
- Mailstream control: Organizations must have sufficient control over their mailstreams to ensure proper SPF and DKIM authentication. This includes understanding all sending sources.
- Technical deep-dives: Beyond basic checks, a detailed examination of failing email samples, including headers and body content, can reveal subtle issues impacting DKIM signing.
- Provider communication: Clear and persistent communication with the ESP is necessary to resolve platform-specific or IP-related authentication glitches. Review this guide on boosting email deliverability rates.
Expert view
Expert from Email Geeks states that organizations should not use DMARC at a policy level beyond p=none unless they have adequate control over their mailstreams to ensure SPF alignment. They further recommend examining specific DKIM failures for issues like RFC 821 violations or encoding problems.
Expert view
Expert from Email Geeks asserts that if an ESP is paid to manage email sending, ensuring proper authentication is their responsibility. They imply that if the ESP hasn't advised against deploying DMARC with unaligned SPF, they might not be adequately monitoring client activities or best practices.
What the documentation says
Official documentation from various email authentication and sending platforms consistently outlines the mechanics of DKIM and DMARC. It clarifies that DKIM failure occurs when an email's digital signature cannot be verified, which in turn leads to DMARC rejection if SPF is also unaligned. The documentation emphasizes that DMARC policies are designed to control how receiving servers handle such authentication failures, impacting overall email deliverability and preventing spoofing.
Key findings
- DKIM failure definition: DKIM fails when the cryptographic signature appended to an email cannot be successfully verified by the recipient server against the public key published in DNS.
- DMARC policy enforcement: DMARC policies (e.g., p=none, p=quarantine, p=reject) dictate how mail servers should handle messages that fail DMARC authentication checks.
- Alignment requirement: For DMARC to pass, either SPF or DKIM (or both) must authenticate and align with the From: domain. If DKIM is missing, SPF alignment becomes critical.
- Common DMARC failure causes: DMARC failures often stem from misconfigured DMARC records or issues with SPF and DKIM implementation, leading to authentication failures.
Key considerations
- Comprehensive DMARC deployment: Documentation recommends a phased DMARC deployment, starting with p=none to gather reports before moving to stricter policies. eSecurity Planet explains why DMARC can fail.
- Email content impact: Changes to email content, such as modifications by forwarders or mailing lists, can break DKIM signatures, leading to authentication failures. This is a common cause of issues.
- Importance of DMARC reports: Official guidelines emphasize that DMARC aggregate and forensic reports are vital for identifying authentication issues and non-compliant sending sources.
- ESP configuration: Email service providers must correctly configure DKIM signing for client domains, including proper selector usage and key management, to ensure successful authentication.
Technical article
Documentation from Kinsta states that a DMARC fail error indicates that an email failed the DMARC authentication process. This often means the email did not pass either SPF or DKIM checks, or that the domains did not align correctly.
Technical article
Documentation from eSecurity Planet explains that DMARC deployment can fail for numerous reasons. Initially, an organization may make mistakes when creating their DMARC record, which can cause DMARC checks to fail. Proper record syntax is crucial.
Related resources
5 resources
Related pages
Why does DMARC authentication fail when SPF and DKIM pass?
Why do emails go to spam from DMARC alignment failures?
Why are some emails failing DMARC checks?
A simple guide to DMARC, SPF, and DKIM
Why your emails get 'DMARC verification failed' errors
Why your emails fail: expert guide
Why are emails intermittently failing authentication?
How to fix DKIM body hash mismatch failures
How to safely transition your DMARC policy
Diagnosing and reducing DKIM temporary error rates
