SendGrid DMARC failures: alignment and policy

TL;DR

Keep every third-party sender for the domain authenticated too; one unsigned service fails the domain's DMARC. Symptom: DMARC aggregate reports show failures for your domain, or receivers quarantine/reject authenticated-looking mail.

Steps

1. Cause candidates:
2. SPF/DKIM not aligned with the From domain (e.g. sending from a subdomain or via a service that signs with its own domain).
3. Forwarding or mailing-list rewriting breaking the DKIM signature.
4. The From domain differs from the authenticated domain (the classic single-sender-on-gmail warning: inbox-provider domains fail DMARC).
5. Confirmation: read your DMARC aggregate reports. They name which checks failed per source.
6. Fix:
7. Authenticate the exact domain in the From header with domain auth (SPF + DKIM via SendGrid's DNS records).
8. Start the DMARC policy at p=none to monitor, then move to quarantine, then reject, only when reports are clean.
9. Keep every third-party sender for the domain authenticated too; one unsigned service fails the domain's DMARC.
10. Verification: DMARC reports show SPF and DKIM passing and aligned, and the failure count drops to zero before tightening the policy.

When to use

You are seeing this: Symptom: DMARC aggregate reports show failures for your domain, or receivers quarantine/reject authenticated-looking mail. Use this skill when you run into "SendGrid DMARC failures: alignment and policy".

When not to use

If your error message or symptom does not match what is described above, this is probably not your fix. Search for your exact error text instead of forcing this one to fit.

Versions

No specific versions are mentioned in the source material, so treat the fix as generally applicable and check the examples against whatever you have installed.

Why this happens

The original report does not dig into a root cause. It documents the symptom and the fix that resolved it.

The domain auth doc: email authentication uses SPF, DKIM, and DMARC as DNS TXT records; DMARC is the policy that tells receivers how to handle messages failing the checks. The single-sender doc warns that large inbox-provider addresses can fail DMARC checks. Sources: https://docs.sendgrid.com/ui/account-and-settings/how-to-set-up-domain-authentication | https://docs.sendgrid.com/ui/sending-email/sender-verification