Diagnose authentication failures
Trace SPF/DKIM/DMARC failures to a remediable cause.
Objective
Monitor authentication failures
Collect and review authentication and reporting signals.
Starting state
Headers, DMARC reports, or provider tools show SPF/DKIM/DMARC failures
Prerequisites
- Failing message sample or aggregate report evidence
- DNS query access
Estimated time
1–2 hours
Difficulty
intermediate
Required access
- DNS
- ESP or MTA admin
Inputs
- Domain
- Failure symptom (SPF/DKIM/DMARC)
- Sending platform and From domain
Step-by-step instructions
- Capture evidenceCollect Authentication-Results headers and/or DMARC report rows for the failing stream.
- Classify the failureSeparate DNS publication errors, alignment mismatches, forwarding breakage, and unknown senders.
- Inspect DNS and signingVerify SPF, DKIM selectors, and DMARC at the authority; confirm the platform is signing/sending as expected.
- Remediate and re-testFix the specific cause, send a controlled test, and confirm the failure class is gone.
Verification
- Root cause documented
- Retest shows expected SPF/DKIM/DMARC results
Common mistakes
- Changing many records at once without isolating the failing path
- Is this forwarding (SPF break) vs true unauthorized send?
- Does the fix belong in DNS, the ESP, or the From identity?
Rollback / recovery
- N/A for diagnosis — revert any experimental DNS changes that hurt production
Expected outcome
Authentication failures are traced to a specific remediable cause and confirmed fixed.
When to escalate
- Production mail impacted unexpectedly