SendGrid DMARC failures: alignment and policy

Symptom: DMARC aggregate reports show failures for your domain, or receivers quarantine/reject authenticated-looking mail.

Cause candidates:

1. SPF/DKIM not aligned with the From domain (e.g. sending from a subdomain or via a service that signs with its own domain).
2. Forwarding or mailing-list rewriting breaking the DKIM signature.
3. The From domain differs from the authenticated domain (the classic single-sender-on-gmail warning: inbox-provider domains fail DMARC).

Confirmation: read your DMARC aggregate reports. They name which checks failed per source.

Fix:

1. Authenticate the exact domain in the From header with domain auth (SPF + DKIM via SendGrid's DNS records).
2. Start the DMARC policy at p=none to monitor, then move to quarantine, then reject, only when reports are clean.
3. Keep every third-party sender for the domain authenticated too; one unsigned service fails the domain's DMARC.

Verification: DMARC reports show SPF and DKIM passing and aligned, and the failure count drops to zero before tightening the policy.

The domain auth doc: email authentication uses SPF, DKIM, and DMARC as DNS TXT records; DMARC is the policy that tells receivers how to handle messages failing the checks. The single-sender doc warns that large inbox-provider addresses can fail DMARC checks. Sources: https://docs.sendgrid.com/ui/account-and-settings/how-to-set-up-domain-authentication | https://docs.sendgrid.com/ui/sending-email/sender-verification