When an email fails authentication, start with the Authentication-Results header. Check SPF first, then DKIM, then whether DMARC policy and alignment pass. A pass on one mechanism is not a DMARC pass. Alignment with the header From domain is the decision that matters. Stop and open a specialized guide as soon as you identify a PermError, missing selector, or pure alignment failure.
The diagnostic order
- Read the Authentication-Results (or equivalent) header on the received message or in your sending log.
- Note the SPF result for the envelope (MAIL FROM) domain.
- Note the DKIM result for each signature selector.
- Check the DMARC result and whether any passing mechanism is aligned with the header From domain.
- Route to the specialized fix only after you know which check failed.
This order avoids the common mistake of raising a DMARC policy when the real problem is a missing DKIM CNAME or an SPF lookup limit.
How we analyzed this
We verified the mechanics against published ArawaMail guides and the current ArawaMail sending documentation. Key confirmed points:
- DMARC requires either aligned SPF or aligned DKIM. An SPF pass on a vendor MAIL FROM domain can still produce a DMARC fail if it does not align with the From domain. See DMARC Alignment vs SPF Pass.
- SPF PermError (too many DNS lookups) is distinct from a softfail or fail. The 10-lookup limit is covered in SPF 10 DNS Lookup Limit.
- DKIM fails when the selector record is missing or the signature does not verify. ArawaMail’s sending activation (after receiving is active) adds the necessary DKIM CNAMEs and custom MAIL FROM MX + SPF records via Cloudflare. Docs do not describe a hosted DMARC policy editor.
- ARC can explain a forward that broke alignment; that topic lives in ARC Email Authentication.
When to stop and open another guide
- spf=permerror — Stop. Do not raise DMARC policy. Follow How to Fix SPF PermError: Too Many DNS Lookups.
- dkim=fail and selector CNAME absent — Check authoritative DNS before changing the DMARC record. For SES Easy DKIM issues, see Amazon SES domain verification stuck.
- spf=pass and dmarc=fail because of alignment — The envelope domain is not aligned with the From domain. Open the alignment article.
- Return-Path / bounce diagnosis — MAIL FROM is the SPF identity. Read Email Return-Path: How to Read MAIL FROM and Diagnose Bounces.
What ArawaMail publishes
When you activate sending on a domain that already has receiving active, ArawaMail uses the Cloudflare connection to:
- Add DKIM CNAME records
- Configure a custom MAIL FROM domain
- Add the corresponding MAIL FROM MX and SPF records
You still publish your own DMARC policy (recommended once SPF and DKIM are stable). See the overview in SPF, DKIM, and DMARC explained and the free checks guide Free Email Authentication Checks.
Related guides
- SPF, DKIM, and DMARC explained
- DMARC alignment
- How to read a DMARC report
- From, Reply-To, and Return-Path
- How to Check DKIM Status and Diagnose Failures
FAQ
Which check comes first?
Start with the Authentication-Results header, then SPF, then DKIM, then DMARC policy and alignment.
Why can SPF pass and DMARC still fail?
Because DMARC requires alignment. An SPF pass on a non-aligned MAIL FROM domain does not satisfy DMARC for the header From domain.
When is the problem a missing DKIM record rather than policy?
When the selector CNAME (or TXT) is absent or the signature fails to verify. Fix DNS before changing the DMARC record.
When should I stop and open the lookup-limit or alignment guide?
Immediately on spf=permerror, or when the header shows a clear alignment mismatch. Those pages own the detailed fix.
What does ArawaMail publish automatically?
DKIM CNAMEs and custom MAIL FROM MX + SPF records at sending activation. You add the DMARC policy yourself.