A message arrives from a known vendor, but the inbox shows “message security verification failed.” The sender insists that SPF and DKIM both pass. The recipient sees a warning, the message lands in quarantine, and nobody can tell whether the problem is spoofing, a broken forwarding path, or a mail rule that reacted too aggressively.
The fastest fix is to stop treating SPF, DKIM, and DMARC as interchangeable checks. SPF and DKIM authenticate different parts of a message. DMARC adds alignment, meaning at least one successful authentication result must correspond to the domain visible in the From address. Once that distinction is clear, the header usually reveals where the delivery chain broke.
Table of Contents
- Why Authentication Passes but Verification Still Fails
- Reading Message Headers to Find the Exact Failure Point
- Fixing the Most Common Authentication and Alignment Errors
- Platform Differences in Gmail and Outlook Error Handling
- Protecting Legitimate Mail During the Remediation Window
- Prevention Checklist for Admins and Power Users
Why Authentication Passes but Verification Still Fails
A passing SPF result doesn't automatically prove that the visible sender is authorized. SPF checks the domain in the SMTP envelope, commonly called the Return-Path or envelope-from domain. DKIM checks whether a signing domain authenticated the message and whether the signed content remained intact. DMARC then compares those authenticated domains with the domain shown to the recipient in the visible From header.
That comparison is the source of many apparently contradictory errors. A third-party mailing platform might pass SPF for its own return-path domain and sign with its own DKIM domain, while the message displays a customer's domain in From. Raw authentication succeeds, but neither result aligns with the visible sender, so DMARC fails.
Practical rule: Passing SPF and DKIM is not enough. At least one of them must pass and align with the visible From domain.
Where legitimate messages lose alignment
Forwarding is a frequent cause. The forwarder may deliver the message from a different server that isn't authorized by the original domain's SPF record. DKIM can survive forwarding, but a gateway, mailing list, or security appliance may change the subject or body after signing, invalidating the signature. Microsoft documents that DKIM can fail when a message is modified after signing, while SPF fails when the sending server isn't included in the domain's SPF record.
Mailing lists create a similar split. The list server may rewrite headers, alter the subject, or send from infrastructure that doesn't match the original sender's authentication configuration. Third-party services can also use a service-owned DKIM domain or Return-Path unless the customer configures custom authentication and alignment.
The problem is widespread rather than a single provider outage. A public Internet study measured transport-level security failures at 10.65% in one measurement set, later falling to 6.14%, a reduction of 4.42 percentage points over time, while failures still persisted at scale (the SMTP security measurement paper). More recent adoption remains uneven. A 2025 global study found 83.9% of observed domains had no visible DMARC record, and only 2.5% enforced a reject policy (Red Sift's global DMARC adoption guide).
Reading Message Headers to Find the Exact Failure Point
The warning shown in an inbox is often less useful than the original header. The Authentication-Results header records what the receiving system evaluated, while the surrounding headers help identify the server, domain, and intermediary that introduced the failure.
Start by opening the original message rather than relying on a forwarded copy. In Gmail, use the message menu to select the option for showing the original message. In Outlook, open the message properties or view the message source, depending on the client and account type. A plain-language reference to the fields worth inspecting is available in what an email header contains.
Read the results in the right order
Find Authentication-Results. Look for separate results for
spf,dkim, anddmarc. Record the domains shown beside the results, not just the words pass or fail.Compare the visible From domain. Read the From header and compare it with the SPF domain and the DKIM
d=domain. If SPF passes for one domain and DKIM passes for another, neither may align with the visible sender.Inspect the Return-Path. The Return-Path identifies the envelope-from domain used for SPF. A sending service may pass SPF for its own domain while the visible From address uses the customer's domain.
Inspect DKIM details. Note the
d=signing domain and selector. A failure can indicate that the content changed after signing, the selector is missing, or the receiving system can't retrieve the expected public key.Trace the delivery path. Read the Received headers from the newest entry downward. Compare the sending IP with the authorized SPF sources and identify gateways, forwarders, or list servers between the original sender and recipient.
Google recommends using DMARC reports to identify failing senders and broken alignment, while Microsoft's troubleshooting guidance emphasizes tracing the sending IP, checking SPF and DKIM, and examining gateways or forwarding services. A recipient-side block can happen after authentication, so a failed delivery doesn't prove the sender's DNS is the only problem.
Fixing the Most Common Authentication and Alignment Errors
Remediation should follow the evidence in the header. Changing several records at once makes it harder to tell which adjustment worked and can create new failures for senders that were already valid.
Correct SPF authorization first
If SPF fails, identify the legitimate service that sent the message and add its documented sending mechanism to the domain's existing SPF policy. The record must remain a single SPF record for the domain, and it should include only authorized services. Removing an existing provider without checking all business systems can break invoices, alerts, newsletters, or support mail.
Operational data points to configuration drift as a major source of legitimate-mail failures. One 2025 analysis across 2,400 domains attributed 38% of DMARC-failing legitimate mail to SPF misconfiguration, while forwarding or mailing-list changes accounted for 29% (the DMARC failure analysis).
Repair DKIM signing and selectors
Confirm that the sender signs with DKIM, that the selector in the message exists in DNS, and that the receiving system can retrieve the corresponding public key. If a gateway modifies the message after signing, configure the gateway and sender to preserve signed content, or arrange for signing to occur after the final modification.
A missing selector, stale key, or provider change can affect one service while leaving other mail untouched. Test the exact sending stream that failed, not a separate transactional or marketing system.
Fix alignment, not just authentication
Configure the sending platform to use a custom aligned Return-Path for SPF or a custom aligned DKIM signing domain. The visible From domain must correspond to at least one passing mechanism. If a vendor can authenticate only with its own domain, its messages may continue to fail DMARC even though its infrastructure is functioning correctly.
Forwarding paths need separate attention. The original sender can't control every intermediary, so administrators should inspect the final Authentication-Results header and use DMARC reports to identify repeat failures.
Review the DMARC policy carefully
A policy change should reflect the current state of legitimate senders. Moving directly to enforcement without inventorying vendors can quarantine or reject valid mail. A monitoring policy provides visibility while teams correct SPF, DKIM, and alignment, after which enforcement can be introduced deliberately.
A practical setup reference for coordinating these records is the SPF, DKIM, and DMARC configuration guide. After each change, send a fresh message through the affected service and inspect the final Authentication-Results header. DNS visibility and provider processing can vary, so an old message isn't proof that a new configuration failed.
Platform Differences in Gmail and Outlook Error Handling
A message can pass SPF and DKIM yet fail DMARC alignment. Gmail and Outlook expose different parts of that problem, so the visible warning rarely identifies the actual fault. End users may see a broad warning or quarantine result. Administrators need raw headers, reports, traces, and rule evaluations.
Gmail favors message evidence and reports
Gmail users can open the original message and inspect its Authentication-Results headers. Google Workspace administrators can use DMARC reports and investigation tools to identify failing sources. Reports reveal recurring patterns, while one message still requires header-level inspection.
Native Gmail filters handle direct conditions such as sender, subject, attachment presence, or message words. Users can preview matching messages before applying actions, or create a rule from an existing message through More, then Filter messages like these (Gmail's filter documentation). That preview reduces accidental routing, but native filters do not offer rich relationship-aware logic, staged activation, or a detailed decision history. During remediation, a filter such as KeepKnown can help retain mail from known contacts or prior correspondents while authentication defects are being corrected.
Outlook separates trace from routing
Microsoft 365 administrators use message trace to investigate delivery and mail flow rules to apply conditions. Exchange rules support exceptions, and Microsoft documents that exceptions override conditions. Multiple exceptions use OR logic, which affects allow-list policies and temporary protection rules (Microsoft's mail flow rule documentation). A reference on Microsoft 365 email security provides related administrative context.
Outlook rules require a name, at least one condition, and an action. Administrators can add conditions, actions, and exceptions, which suits linear routing such as moving vendor mail into a folder (Outlook rule guidance). Limits appear when a team needs nested all/any logic, safe testing with real mail, paused deployment, or a clear record of which branch made the decision.
KeepKnown supports richer conditions and outcomes across Gmail, Google Workspace, Outlook, and Microsoft 365. Provider support determines the available actions and enforcement modes, so Gmail and Outlook should not be treated as feature-equivalent.
Protecting Legitimate Mail During the Remediation Window
Authentication changes don't repair every message already in transit, and a forwarding or vendor issue can continue while teams coordinate a fix. The inbox still needs a temporary routing policy that protects known business relationships without treating every unauthenticated sender as malicious.
A relationship-aware filter can use contacts, prior replies, VIP domains, sender groups, headers, subject metadata, attachments, and mailbox state. For example, a founder's inbox might route mail from a known customer domain into the primary inbox when the sender is a saved contact or the recipient has replied previously, while placing unfamiliar messages from the same broad category into a review queue.
KeepKnown is an advanced email filter builder for Gmail, Google Workspace, Outlook, and Microsoft 365. It supports up to 20 conditions and three nested group levels, with outcomes that can keep, move, label or categorize, prioritize, hold for review, or add matching mail to a digest. Core filtering doesn't read email bodies, and subject-based rules can use encrypted subject metadata.
Test before changing the inbox
New filters save paused, which gives an administrator an opportunity to preview the rule against real mail before activation. Where the connected provider supports it, Shadow, Review Only, and Enforce modes provide a staged path from observation to action.
A safe workflow looks like this:
- Start with a protected relationship: Match a known contact, prior reply, or approved domain instead of relying only on an authentication result.
- Add an exception for uncertainty: Keep high-risk attachments or unusual mailbox states in review rather than routing them directly to the inbox.
- Preview real messages: Check both intended matches and near misses before enabling enforcement.
- Record the decision: Use the filter history to identify which rule matched, why it matched, and what happened next.
- Retire temporary logic: Once vendor authentication and DMARC alignment are stable, narrow or remove the temporary routing path.
The result isn't permanent blocking of unknown mail. Supported routing remains recoverable, and the filter can protect an important conversation while domain-level remediation continues.
Prevention Checklist for Admins and Power Users
Authentication maintenance is an operating process, not a one-time DNS task. Vendor changes, forwarding paths, new gateways, and renamed selectors can create drift that appears only after an important message is quarantined. The checklist should focus on both raw SPF or DKIM passes and DMARC alignment, because a message can pass authentication while still failing the identity check that affects delivery.
- Review DMARC reports regularly: Check failing sources, alignment results, and unexpected senders. Google recommends daily report review while diagnosing active DMARC issues (Google Workspace DMARC troubleshooting).
- Audit SPF after service changes: Update authorized senders when a CRM, billing system, support platform, or marketing vendor changes.
- Verify DKIM selectors: Confirm that each legitimate service signs messages and that its published selector remains available.
- Test forwarding workflows: Send through shared mailboxes, mailing lists, gateways, and forwarding addresses. Inspect the final
Authentication-Resultsheader for both authentication and alignment. - Document ownership: Record the team responsible for each sender domain, selector, vendor integration, and DMARC report destination.
- Trace recurring Outlook failures: Correlate the sending source, rule action, exception, and final delivery result.
- Preview inbox safeguards: Test routing against real messages before enforcement. Gmail filter previews and account settings support controlled rule creation, while the Gmail API exposes filters through its account-level
settings.filtersresource (Gmail API filter settings).
During remediation, preserve legitimate conversations with a relationship-aware safeguard such as KeepKnown's KeepKnown filter. Use known contacts, prior replies, or approved domains as conditions, then review matches before routing. This limits legitimate mail loss while sender configuration and DMARC alignment are corrected.
KeepKnown provides filters for Gmail, Google Workspace, Outlook, and Microsoft 365, including real-mail previews, paused activation, relationship-aware conditions, and decision history for each match. Visit KeepKnown to configure a temporary protection path while authentication and alignment issues are being fixed.