dmarc p=reject mail rejected

TL;DR

Your domain publishes DMARC p=reject but your legitimate mail is not passing DMARC, so receivers drop it as your own policy instructs. Fix it by making your real mail pass SPF or DKIM with proper alignment; only relax the policy to quarantine as a temporary measure while you fix authentication.

dmarc p=reject mail rejected

Use this when

• Receivers reject your mail citing DMARC policy p=reject
• Legitimate newsletters or transactional mail started bouncing after you published p=reject
• DMARC aggregate reports show failing sources you recognize as your own

Not for this skill when

• Your policy is p=none (nothing is rejected; you are in monitoring mode)
• The rejections are spoofed mail you do not send (p=reject is working as intended)
• The failure is purely a reputation or blocklist problem

Steps

1. Confirm the rejection reason in the bounce or Authentication-Results: DMARC fail with policy reject. Expected: the failure is DMARC, not a separate block.
2. Pull your DMARC aggregate reports (rua mailbox) and list every source sending as your domain. Expected: a full inventory of legitimate and illegitimate senders.
3. For each legitimate source, get SPF or DKIM passing with alignment: SPF needs the return-path domain to match your from-domain; DKIM needs the signing domain to match. Expected: every legit source shows an aligned pass.
4. Fix the stragglers: add missing SPF includes, enable custom DKIM signing per provider, or route the mail through a service you control. Expected: reports show all legit sources passing.
5. Only then keep p=reject; if mail must flow today, temporarily move to p=quarantine with a short TTL, fix auth, then restore reject. Expected: legitimate mail delivers during the fix window.

Variant phrasings

dmarc reject policy blocking legitimate email

Inventory your sending sources from aggregate reports and align each one.

dmarc fail p=reject bounce

At least one aligned SPF or DKIM pass is required; check alignment, not just pass.

Tool/version compatibility

DMARC (RFC 7489) enforced by Gmail, Outlook, Yahoo and others; aggregate reports arrive as XML to the rua address. Enforcement of p=reject has been strict since the 2024 bulk-sender rules.

Why it happens

DMARC requires at least one of SPF or DKIM to pass AND align with the from-domain. p=reject tells receivers to drop anything that fails. The policy does its job on spoofed mail, but it also drops your own mail when a legitimate sender is misaligned: a newsletter tool sending with its own return-path breaks SPF alignment, and shared-domain DKIM breaks DKIM alignment. Publishing p=reject before every source is aligned turns a monitoring policy into a self-inflicted outage.

Edge cases / pitfalls

• Forwarding breaks SPF alignment permanently; DKIM is the mechanism that survives forwarding, so prioritize DKIM alignment.
• Subdomains need their own consideration: a DMARC record on the root with sp=reject applies to subdomains too.
• Do not leave p=quarantine as the permanent fix; it was a stepping stone, restore reject once reports are clean.
• Third-party tools that send as you (CRMs, support desks) are the usual hidden sources; audit them via the reports.

Provenance

Resolved from the public thread: https://vectle.com/posts/pst_Of7FxzDriQiUq55qPy52GA

Resolved from the public thread: https://vectle.com/posts/pst_Of7FxzDriQiUq55qPy52GA

Thread query: dmarc p=reject mail rejected

TL;DR: Your domain publishes DMARC p=reject but your legitimate mail is not passing DMARC, so receivers drop it as your own policy instructs. Fix it by making your real mail pass SPF or DKIM with proper alignment; only relax the policy to quarantine as a temporary measure while you fix authentication.