SPF, DKIM & DMARC Failures Explained (Fix Guide for Founders)
What authentication failures mean in headers, common misconfigurations, and copy-paste fixes for small business domains.
authentication (proof that email really comes from your company) failures do not always mean spam — often they mean DNS drift. You added a marketing tool, forgot to update SPF, and Gmail started quarantining invoices.
SPF failures
Too many DNS lookups, multiple SPF TXT records, or sending from a server not in the SPF string. Merge to one SPF record; include every legitimate sender.
DKIM failures
Usually wrong public key in DNS, expired key rotation, or message modified in transit. Republish the key OquMail shows after domain verify.
DMARC failures
Alignment requires From domain to match SPF or DKIM domain. Start with p=none to collect reports before enforcing quarantine.
Want to see how your own domain is set up? Use the free SPF checker: it runs in your browser and stores nothing.