DMARC failures
Decision-tree troubleshooting guide for neither aligned spf nor aligned dkim passes in PowerMTA environments.
Review before production. Adapt hostnames, IPs, credentials, paths and limits to your licensed PowerMTA release and validate syntax in a staging environment.
Symptom
Neither aligned SPF nor aligned DKIM passes.
First response: Inspect visible From alignment, return-path domain and DKIM d= domain.
Decision tree
Start: Neither aligned SPF nor aligned DKIM passes
↓
1. Contain risk and preserve logs
↓
2. Identify scope by VMTA, authenticated user, provider and time
↓
3. Compare with last known-good configuration and baseline
↓
4. Apply one reversible correction
↓
5. Validate with controlled traffic and accounting logs
Evidence to collect
- Exact timestamp and timezone
- Authenticated username or submission source
- Envelope sender and recipient domain
- Selected VMTA, source IP and HELO
- SMTP response and enhanced status code
- Relevant accounting and service-log records
- Last configuration change
Safe corrective sequence
- Pause only the affected stream when possible.
- Preserve the original response and configuration.
- Reproduce with one controlled test.
- Apply the smallest reversible change.
- Verify queue behavior and document the outcome.
Avoid
- Deleting queues before preserving evidence.
- Changing many directives simultaneously.
- Rotating source identities to bypass reputation controls.
- Assuming every temporary error is a rate problem.