I've setup SPF and DKIM for my custom domain to send emails. While SPF and DKIM tests pass, the DMARC test fails for emails that have reply-to address different from "From" field. My SPF record:

v=spf1 include:amazonses.com include:_spf.google.com -all

My DMARC record:

v=DMARC1; p=none; pct=100; rua=mailto:dmarc-rua@mydomain.com; ruf=mailto:reports@mydomain.com

Headers from the email sent:

Delivered-To: contact@mydomain.com
Received: by with SMTP id c184csp206242ywh;
        Thu, 19 May 2016 03:56:53 -0700 (PDT)
X-Received: by with SMTP id d201mr13984760qkg.41.1463655413313;
        Thu, 19 May 2016 03:56:53 -0700 (PDT)
Return-Path: <01000154c8a933ce-e7e039ee-6c9d-4e64-9693-28708e049ecf-000000@amazonses.com>
Received: from a8-86.smtp-out.amazonses.com (a8-86.smtp-out.amazonses.com. [])
        by mx.google.com with ESMTPS id g90si11881962qgg.13.2016.
        for <contact@mydomain.com>
        (version=TLS1 cipher=ECDHE-RSA-AES128-SHA bits=128/128);
        Thu, 19 May 2016 03:56:53 -0700 (PDT)
Received-SPF: pass (google.com: domain of 01000154c8a933ce-e7e039ee-6c9d-4e64-9693-28708e049ecf-000000@amazonses.com designates as permitted sender) client-ip=;
Authentication-Results: mx.google.com;
       dkim=pass header.i=@amazonses.com;
       spf=pass (google.com: domain of 01000154c8a933ce-e7e039ee-6c9d-4e64-9693-28708e049ecf-000000@amazonses.com designates as permitted sender) smtp.mailfrom=01000154c8a933ce-e7e039ee-6c9d-4e64-9693-28708e049ecf-000000@amazonses.com;
       dmarc=fail (p=NONE dis=NONE) header.from=mydomain.com
DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/simple;
    s=6gbrjpgwjskckoa6a5zn6fwqkn67xbtw; d=amazonses.com; t=1463655412;
From: "MYDOMAIN.COM" <no-reply@mydomain.com>
Reply-To: someaddress@gmail.com
To: contact@mydomain.com

What could be an issue here?


Your DKIM is unaligned and your SPF might be un-aligned (I can't tell without real domain names) and that will cause your DMARC to fail. One of the two must be in alignment, you can read more about that here: Indentifier Alignments

You can also send an email to mailtest@unlocktheinbox.com and will pinpoint the DMARC issue. But the DMARC report section of the report is a paid feature, but it's cheap.

  • Thank you very much for the answer. I'm trying to identify the issue. The domain name is: luckstock.com I'm still digging deeper to sort it out and your help will be appreciated. – user1537407 Jun 1 '16 at 10:44
  • 1
    Yes your DKIM and SPF are both out of alignment, in your case they are the same amazonses.com and luckstock.com. They don't match, as you can see. If you continue to send mail this way you should remove your DMARC policy. You can read that Amazon won't let you change the Return-Path Here: Amazon SES. So your SPF will never be algined as well as your DKIM. Wouldn't it be easier to just set up your own mail server? With PostFix or Exim and have full control over your emailing. – Henry Jun 1 '16 at 13:30

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.