Start free
Menu
In this section

How-to guides

Fix a source that fails DMARC

On every plan

Open the source's page. Under What we see, a sentence says why its mail fails DMARC, and ends with what to change. The change itself happens in the sending service or in your DNS, not in Mailmoni. See the playbook opens the steps for that change.

Find the source

  1. Open the domain and go to Sources. The list shows every source that sent mail as the domain in the window, and how much of its mail passes DMARC.
  2. Press Explain under a source's status to read its explanation in the list, or open the source by its name.

The Readiness page lists the sources that hold the domain back from a stricter policy, each with what to do. Start with those. When mailbox providers refuse a source's mail or send it to spam, the domain's Home tab names that source first, at the top of the tab and in its list of what to do next.

Read what to change

What we see says how many messages fall into each case, and why. When a case needs a change, its sentence ends with it. These are the changes we suggest, and what each one means:

  • Turn on DKIM for your own domain in the service. The service signs your mail with its own domain. DKIM passes, but DMARC only counts a signature whose domain is yours.
  • Set up DKIM for your domain in the service. The mail carries no DKIM signature with your domain. SPF may still pass for it, but SPF alone breaks as soon as the mail is forwarded.
  • Turn on custom DKIM and a custom bounce domain. SPF and DKIM both pass, but for the service's domain, not yours. You need both settings in the service.
  • Check the DKIM key for the selector in DNS. The mail is signed with your domain, but the signature fails. The key in DNS is missing, has changed, or is not the one the service signs with.
  • Fix the SPF record. SPF returns an error for your domain, and no DKIM signature of yours covers the mail. Or DKIM passes and SPF fails: the mail passes DMARC, but Gmail and Outlook.com ask bulk senders for SPF to pass as well. The DNS tab shows what is wrong with the record.
  • Set up the service for your domain, or confirm nobody uses it. We recognise the service, but none of its mail passes. If nobody at your organization uses it, treat it as someone sending as you.
  • Find out who sends from this source. We do not recognise the source. Its page lists every address behind it, with the reverse DNS name, network and country of each.

One sentence ends with a fact instead of a change: the service cannot sign mail with your domain. The service's own pages describe no setting for it, so DKIM there cannot align. When the service cannot sign for your domain lists what you can do instead.

Open the guide

See the playbook opens the guide at the section for this change. When we have a guide for the service that covers the change, you get that guide. Otherwise you get the general guide for the change, with the service's name in it. Playbooks in the menu lists every guide. The same guides are public, in the list of sending services, such as those for Google Workspace, Microsoft 365 and Mailchimp.

Mail that needs no fix

Some failing mail needs nothing from you. When a mailbox provider reports that a message was forwarded, or came through a mailing list, the explanation says so and suggests no change. Forwarding breaks SPF by design, and a mailing list that changes the message breaks its signatures.

A source we do not recognise, whose mail never passes DMARC, is probably someone sending as you without your permission. Nothing in your setup fixes that. It does not count against readiness, and a stricter policy tells mailbox providers to refuse its mail.

Check that it worked

Most mailbox providers send one report a day, so the reports of the next day or two show the result. Open the source again: the daily chart on its page shows the share of its mail that passes. Each guide ends with a section that says what to look for.

Then move on

When every source the readiness rule counts passes, the readiness page says the domain is ready for a stricter policy. Move to a stricter DMARC policy shows the steps.

Published 27 October 2026 · Checked 27 October 2026