What the receiver is telling you

The From domain publishes a DMARC record with p=reject, this message did not have an aligned SPF or DKIM pass, and the receiver rejected it as the policy instructs. Most often the sender is you, sending from a tool that authenticates as itself rather than as you. Occasionally it is genuine spoofing being stopped, which is what the policy is for. The alignment checker tells you which.

Why a policy block must not be treated as a bad address

Sending tools file every 5xx under "bounced", and the natural reflex is to scrub the address. For a policy block that is exactly wrong. The recipient exists and would have received the mail; the receiver refused it because of your domain, IP, authentication or content. Scrubbing throws away a lead and leaves the cause in place, so the next send produces the same block against the next thousand addresses. The right response is to stop sending from the affected domain, find what the receiver named, fix it, and resume at low volume.

What to do

1. Check the message headers in the DMARC alignment checker. It shows the From domain, the SPF identifier, every DKIM d= and whether any aligned.
2. Fix DKIM: sign with a key on the From domain (or a subdomain of it under relaxed alignment). Every major sending tool supports a custom DKIM domain.
3. Fix SPF alignment as a second layer: set the tool's custom return-path domain to a subdomain of the From domain.
4. Check adkim and aspf in the record; strict mode breaks subdomain setups that would pass relaxed.

don't Do not fix it by changing the policy to p=none. The messages will deliver, and so will everyone else's forgeries of your domain.

Decode the whole bounce

Paste the complete failure notice — every code and the receiver's wording — and get each part explained together.

Common questions