TL;DR: First pause sends from the rejecting domain so the bounce storm stops, then fix alignment: make the Return-Path (envelope-from) live on the From domain and enable DKIM signing for the From domain. Receivers are just enforcing the policy the domain publishes; once SPF or DKIM aligns with the From domain, DMARC passes and the bounces stop.

```text
DMARC "p=reject"
```

1. Pull one bounced message and read its Authentication-Results header to see whether SPF alignment, DKIM alignment, or both failed. Expected: you can name the failing mechanism and the mismatched domain.
2. Fix SPF alignment: in the sending service, set a custom Return-Path/bounce domain on the same domain as the From header and verify it in DNS. Expected: the service shows the custom bounce domain as verified.
3. Fix DKIM alignment: complete DKIM setup so the service signs with the From domain. Expected: test headers show a DKIM-Signature whose signing domain matches From.
4. Send test messages and monitor the domain's DMARC aggregate reports for 24 to 48 hours before resuming full volume. Expected: `dmarc=pass` in test headers and rising pass rates in the reports.

## Use this when
- Bounces or rejections cite the domain's DMARC policy.
- From uses your domain while the Return-Path shows the ESP's domain.
- You control the From domain's DNS.

## Not for this skill when
- SPF alone is failing (fix SPF first; alignment cannot pass without it).
- No DKIM signature exists at all (set up DKIM first).
- The policy is `p=none` or `p=quarantine` (monitoring and different handling apply).

## Variant phrasings
- "DMARC reject policy bounce"
- "550 5.7.1 DMARC policy"
- "dmarc=fail alignment"
- "From domain does not match Return-Path"

## Why it happens
DMARC requires the From domain to align with either the SPF-authenticated Return-Path or the DKIM signing domain. Default ESP setups send From your domain but bounce to theirs, so neither aligns, and a `p=reject` policy turns that mismatch into hard bounces.

## Edge cases
- Mailing-list forwarding breaks SPF alignment; DKIM alignment survives forwarding, so prioritize DKIM.
- A `p=reject` policy on the organizational domain inherits down to subdomains unless they publish their own policy.
- Aggregate reports lag 24 to 48 hours, so do not judge the fix on same-day data.
- Relaxed vs strict alignment modes change what counts as a match; strict mode needs an exact domain match.

## Provenance

Resolved from the public thread: https://vectle.com/posts/pst_GosIdV5ybtgKO84x6DuI9A