Reading your senders
The sender cards on the DMARC page group every source in your reports into the services that send as you, and tell you which ones fail and how to fix each.
How a sender is named
- A known provider. When the sending address is inside a range a provider publishes, the card carries that provider's name (Google Workspace, Mailchimp, SendGrid…). Some ranges are used by several services; the card then lists "Also used by" the others.
- An unknown address with a known network. Otherwise the card names the network that owns the address, such as "Unknown · OVH (AS16276)", and when the card holds a single address, its reverse DNS name (PTR) too.
- Nothing known: "Unknown Source".
The three groups
| Group | What is in it |
|---|---|
| Needs review | Senders nobody has classified yet. Mark each one Mine or Not mine. |
| Yours | Senders you marked as your own. Their results are what enforcement depends on. |
| Not yours, and relayed mail | Senders you marked as not yours, and your own mail that someone else forwarded or sent through a mailing list. |
Each card also carries a badge: Aligned (90% or more of its mail passes DMARC), Partial, Failing or Not reported.
The New badge
A card is marked New when its addresses were first seen in a report within the last 7 days, counted by the date the mail was sent. When only some of a card's addresses are new, it reads "2 new". A new unknown sender with real volume also raises an alert ("New unknown sender").
Forwarded / list — don't block
Mail you sent that someone forwarded, or that went through a mailing list, often fails SPF on the way, because the forwarding server is not in your record. The card says Forwarded / list — don't block when the receivers reported the mail as forwarded, or when a mailbox provider's mail fails SPF but still carries your own domain's valid DKIM signature. It is your mail, relayed by someone else. Blocking it would stop your own messages reaching the people it is forwarded to; under p=reject, receivers still act on it wherever DKIM did not survive the trip.
Fixing a failing sender
A card for a known provider that is not aligned says which of three problems it has, and the fix for each:
| What the card says | What it means | The fix |
|---|---|---|
| SPF fix | The provider's addresses are not in your SPF record. | Press Add to your SPF (hosted SPF), or add the provider's include to your own record. |
| SPF fix · return-path | SPF is checked on the provider's bounce domain, not yours, so no include in your record can make it align. | Set up a custom return-path (bounce) domain under yours in the provider's settings. If it offers none, rely on DKIM for this mail. |
| DKIM fix | The provider does not sign with your domain, or the signature does not verify. | Enable DKIM for your domain in the provider's settings, then connect it on the DKIM page. If a signature fails, re-copy the record from the provider. |
DMARC passes when either SPF or DKIM passes and aligns, so one good fix is enough. DKIM is the sturdier of the two, because it survives forwarding. See Alignment failures.