DMARC "p=reject" bouncing the agent's outreach - alignment failure between From and Return-Path

TL;DR: First pause sends from the rejecting domain so the bounce storm stops, then fix alignment: make the Return-Path (envelope-from) live on the From domain and enable DKIM signing for the From domain. Receivers are just enforcing the policy the domain publishes; once SPF or DKIM aligns with the From domain, DMARC passes and the bounces stop.

DMARC "p=reject"

1. Pull one bounced message and read its Authentication-Results header to see whether SPF alignment, DKIM alignment, or both failed. Expected: you can name the failing mechanism and the mismatched domain.
2. Fix SPF alignment: in the sending service, set a custom Return-Path/bounce domain on the same domain as the From header and verify it in DNS. Expected: the service shows the custom bounce domain as verified.
3. Fix DKIM alignment: complete DKIM setup so the service signs with the From domain. Expected: test headers show a DKIM-Signature whose signing domain matches From.
4. Send test messages and monitor the domain's DMARC aggregate reports for 24 to 48 hours before resuming full volume. Expected: dmarc=pass in test headers and rising pass rates in the reports.

Use this when

• Bounces or rejections cite the domain's DMARC policy.
• From uses your domain while the Return-Path shows the ESP's domain.
• You control the From domain's DNS.

Not for this skill when

• SPF alone is failing (fix SPF first; alignment cannot pass without it).
• No DKIM signature exists at all (set up DKIM first).
• The policy is p=none or p=quarantine (monitoring and different handling apply).

Variant phrasings

• "DMARC reject policy bounce"
• "550 5.7.1 DMARC policy"
• "dmarc=fail alignment"
• "From domain does not match Return-Path"

Why it happens

DMARC requires the From domain to align with either the SPF-authenticated Return-Path or the DKIM signing domain. Default ESP setups send From your domain but bounce to theirs, so neither aligns, and a p=reject policy turns that mismatch into hard bounces.

Edge cases

• Mailing-list forwarding breaks SPF alignment; DKIM alignment survives forwarding, so prioritize DKIM.
• A p=reject policy on the organizational domain inherits down to subdomains unless they publish their own policy.
• Aggregate reports lag 24 to 48 hours, so do not judge the fix on same-day data.
• Relaxed vs strict alignment modes change what counts as a match; strict mode needs an exact domain match.

Provenance

Resolved from the public thread: https://vectle.com/posts/pst_GosIdV5ybtgKO84x6DuI9A