Engineering Glossary · Deliverability
DMARC: Alignment Is the Part That Actually Fails
Mail that shows spf=pass and dkim=pass in the headers and still fails DMARC is not a mystery; it is an alignment problem, and it has a name in the report.
The short answer
DMARC is the policy layer above SPF and DKIM: it tells receivers what to do with mail that fails those checks, and it sends you aggregate reports on everything sending as your domain.
The mechanism people miss is alignment. DMARC does not care that SPF passed; it cares that the domain SPF passed for matches the domain in the From header a human reads. A bulk platform sending with its own bounce domain will show spf=pass and still fail DMARC, because the authenticated identity and the visible identity are different. Fixing that is a configuration change at the sender, not a DNS edit at your end.
By the HostingFast team · Reviewed 12 August 2026
0
Jargon left undefined
100+
Entries, all cross-linked
Real
Working examples
Free
To read, always
A _dmarc TXT record carries the policy, and there are three settings: none for monitoring, quarantine to divert failures to spam, reject to refuse them altogether. Aggregate reports come back listing every source sending as your domain, the genuine and the fraudulent alike.
Sequence matters. Publish p=none first and read the reports until every forgotten sender has identified itself, then move up the scale once everything legitimate passes.
Alignment, not authentication
There are two alignment tests and either one is enough. SPF alignment compares the domain in the envelope sender with the From domain. DKIM alignment compares the signing domain in the header.d= tag with the From domain. Relaxed mode accepts an organisational match, so mail.yourdomain.com aligns with yourdomain.com; strict mode demands an exact match and is rarely worth the trouble.
This is why a bulk platform can produce a message where both checks pass and DMARC still fails. It authenticated as its own domain, not as yours. The remedy is to configure a custom return-path or a DKIM signature under your own domain at that platform — a setting on their side, which is why the aggregate report is the tool that finds it.
The aggregate reports are XML, and they are worth parsing
Point rua= at a mailbox and receivers send a daily gzipped XML file each. Each record names a source IP, a message count, the SPF and DKIM results and, critically, whether each aligned. Unzip a day's worth and you have a census of everything sending as your domain: your hosting, your CRM, an invoicing tool somebody set up in 2021, and whoever is forging you.
Read it as a percentage, not as a feeling. The number to watch is the share of messages that pass DMARC through either alignment path. Below 100% you have a legitimate sender that is not aligned yet, and moving to enforcement will bounce it. When the figure sits at effectively 100% for a fortnight, including a month-end when the invoice run fires, the list is complete.
Ramping with pct= instead of jumping
The pct= tag applies the policy to a sampled fraction of failing mail. Publishing p=quarantine with pct=10 means one failing message in ten goes to spam and the rest are delivered as before, so a sender you missed produces a handful of complaints rather than an outage across a whole department.
A sensible ladder is p=none until the reports are quiet, then p=quarantine at pct=10, then 50, then 100, and only then p=reject. Each rung stays up for at least a full billing cycle, because the sender you have forgotten is almost always the one that fires monthly.
Where this lands on HostingFast
The _dmarc record is published from the same DNS editor as everything else, so raising a policy rung is a one-line change with no ticket in the way. Backups run daily on every plan, and restoring a file or a database is a single click in the panel, not a support ticket.
Follow-on entries: SPF, DKIM, TXT Record and Phishing — the last of which is what enforcement is actually there to stop.
Definitions written for people who deploy
Every entry here started life as a support ticket. Rather than explain the same term for the two hundredth time, we wrote it down properly — with the record syntax, the tag names and the evidence to read before changing anything.
Order an annual plan and the first year of your domain registration costs you nothing.
- 100+ entries, each with the mechanism spelled out
- Commands you can paste, numbers you can compare against
- Neighbouring terms wired together at the foot of every page
- Written by the engineers who answer the tickets
Why HostingFast
Standard on every plan
Evidence before enforcement
Every entry that changes behaviour says what to measure first, and what number means it is safe to proceed.
Tags spelled out
p=, pct=, rua= and the alignment modes are named with what each one actually does to live mail.
The distinction that matters
Authentication and alignment are different things, and confusing them is the reason most DMARC rollouts stall.
Rollout as a ramp
Where a change can be sampled rather than switched, the entry gives you the ladder and the dwell time on each rung.
Wired to its neighbours
DMARC runs into SPF, DKIM and Phishing — the checks it governs and the fraud it exists to stop.
This term, landed
DMARC defined, its reports parsed and its ramp mapped out — enough to plan a rollout with dates on it.
Quick Start
From order to online
- 1
Publish p=none with rua= pointed somewhere
Monitoring costs nothing and changes no mail flow. Without reports you are guessing at who sends as you, and guessing is what breaks enforcement.
- 2
Parse a fortnight of XML and read the pass rate
Count messages passing through either alignment path as a percentage. Anything short of effectively 100% names a sender you have not aligned yet.
- 3
Ramp with pct= before you reject
quarantine at 10, then 50, then 100, each rung held for at least a full billing cycle so the monthly invoice run gets a chance to appear.
Built In
Loaded onto every plan
- cPanel's DNS Zone Editor, not a fixed set of preset records
- Mailboxes on your own domain, included with the plan
- LiteSpeed caching built into the server rather than bolted on by plugin
- Real SSH, plus Git and Composer, on the developer-focused plans
- NVMe SSD storage on every tier, not only the expensive ones
- Staging environments, so a change gets measured before it ships
- Spam and virus scanning on every mailbox by default
- Browser webmail plus IMAP, POP and SMTP for any mail client
- Daily backups with self-service restores you run yourself from the panel
- Human support on duty every hour of every day
Frequently Asked
What people ask us most often
Mail passes SPF and DKIM but still fails DMARC — why?
Alignment. DMARC requires the domain that passed a check to match the domain in the visible From header. A bulk platform authenticating under its own bounce domain will show spf=pass and fail DMARC, because it proved its identity rather than yours. The fix is a custom return-path or a DKIM signature under your domain, configured at that platform.
Do I have to read raw XML to make use of the reports?
You have to read something derived from it. Each record names a source IP, a message count, both check results and whether each aligned — that is the census you need before enforcement. Parse it yourself or feed it to a tool, but do not skip it: the entire risk in a DMARC rollout is the legitimate sender nobody remembered, and the report is the only place it appears.
What does the pct= tag actually do?
It applies your policy to a sampled fraction of failing mail. p=quarantine with pct=10 sends one failing message in ten to spam and delivers the rest normally. That turns a missed sender into a few complaints instead of a department-wide outage, which is why the ladder from 10 to 50 to 100 is worth the extra fortnight it costs.
Can I restore a database without opening a ticket?
Yes. Every plan gets a daily backup, and the restore runs from your panel in minutes — files, databases or both, at three in the morning with no queue in the way. Keeping an additional copy offsite is still a sensible habit, and nothing here stops you doing it.
Keep reading
SPF (Sender Policy Framework)
The transport-side check DMARC governs, and the lookup ceiling that quietly breaks it.
Phishing
Impersonation as an attack, and what enforcement actually removes from an attacker's toolkit.
How to Publish a DMARC Policy
Publishing the policy in the order that does not bounce your own invoice run.
Dedicated Cloud
Reserved resources plus cloud flexibility — the next gear up from a VPS.
AI Website Builder
Tell the AI what you need and it drafts your site on real hosting.
Changing hosts? Run through our checklist first.
A straightforward sequence for a switch your visitors never feel: which files move first, how to shift email across without losing a single message, the right moment to repoint DNS, and the two mistakes behind almost all the downtime we get asked to rescue.
Enforce it on evidence, not nerve.
Full DNS control in the panel, mailboxes included, daily backups with self-service restores, and support at any hour.
View Dedicated Cloud plans