Gmail is marking my email messages as Spam. The messages pass SPF and DKIM, but fail DMARC. Is there some way to make my messages pass DMARC?

I recently signed up for WordPress hosting at Flywheel, which uses Mandrill for transactional email. My site has several forms that send email notifications when they are submitted.

I am attaching the raw source of a sample message:

Delivered-To: [email protected]
Received: by with SMTP id m5csp1332570itc;
        Sun, 1 Feb 2015 23:03:34 -0800 (PST)
X-Received: by with SMTP id 6mr7036797yhe.179.1422860614601;
        Sun, 01 Feb 2015 23:03:34 -0800 (PST)
Return-Path: <bounce-md_30068542.54cf2145.v1-57b0f565d61f4314ae4398e41d1cf6f7@mandrillapp.com>
Received: from mail128-15.atl41.mandrillapp.com (mail128-15.atl41.mandrillapp.com. [])
        by mx.google.com with ESMTPS id g67si3643342yhd.195.2015.
        for <[email protected]>
        (version=TLSv1.2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128);
        Sun, 01 Feb 2015 23:03:34 -0800 (PST)
Received-SPF: pass (google.com: domain of bounce-md_30068542.54cf2145.v1-57b0f565d61f4314ae4398e41d1cf6f7@mandrillapp.com designates as permitted sender) client-ip=;
Authentication-Results: mx.google.com;
       spf=pass (google.com: domain of bounce-md_30068542.54cf2145.v1-57b0f565d61f4314ae4398e41d1cf6f7@mandrillapp.com designates as permitted sender) smtp.mail=bounce-md_30068542.54cf2145.v1-57b0f565d61f4314ae4398e41d1cf6f7@mandrillapp.com;
       dkim=pass [email protected];
       dmarc=fail (p=QUARANTINE dis=QUARANTINE) header.from=seesawsf.com
DKIM-Signature: v=1; a=rsa-sha1; c=relaxed/relaxed; s=mandrill; d=mail128-15.atl41.mandrillapp.com;
 h=From:Sender:Subject:To:Message-Id:Date:MIME-Version:Content-Type; [email protected];
DomainKey-Signature: a=rsa-sha1; c=nofws; q=dns; s=mandrill; d=mail128-15.atl41.mandrillapp.com;
Received: from pmta04.atl01.mandrillapp.com ( by mail128-15.atl41.mandrillapp.com id hpsgkc1mqukr for <[email protected]>; Mon, 2 Feb 2015 07:03:34 +0000 (envelope-from <bounce-md_30068542.54cf2145.v1-57b0f565d61f4314ae4398e41d1cf6f7@mandrillapp.com>)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=mandrillapp.com; 
 [email protected]; q=dns/txt; s=mandrill; t=1422860613; h=From : 
 Sender : Subject : To : Message-Id : Date : MIME-Version : Content-Type 
 : From : Subject : Date : X-Mandrill-User : List-Unsubscribe; 
From: seesaw registration <[email protected]>
Sender: seesaw registration <[email protected]>
Subject: [removed]
Return-Path: <bounce-md_30068542.54cf2145.v1-57b0f565d61f4314ae4398e41d1cf6f7@mandrillapp.com>
X-Sg-User: flywheelxxxxx
X-Sg-Opt: PWD=/www
X-Php-Originating-Script: 0:class-phpmailer.php
X-Priority: 3
X-Mailer: PHPMailer 5.2.7 (https://github.com/PHPMailer/PHPMailer/)
To: <[email protected]>
Message-Id: <[email protected]>
Received: from [] by mandrillapp.com id 57b0f565d61f4314ae4398e41d1cf6f7; Mon, 02 Feb 2015 07:03:33 +0000
X-Report-Abuse: Please forward a copy of this message, including all headers, to [email protected]
X-Report-Abuse: You can also report abuse here: http://mandrillapp.com/contact/abuse?id=30068542.57b0f565d61f4314ae4398e41d1cf6f7
X-Mandrill-User: md_30068542
Date: Mon, 02 Feb 2015 07:03:33 +0000
MIME-Version: 1.0
Content-Type: multipart/alternative; boundary="_av-S0IDuFcF1O5aP8YpCVA_Kg"

Content-Type: text/plain; charset=utf-8
Content-Transfer-Encoding: 7bit

[ removed message content ]

Content-Type: text/html; charset=utf-8
Content-Transfer-Encoding: 7bit

[ removed message content ]


3 Answers 3


You'll need to add a Mandrill DKIM record for your domain. The SPF and DKIM pass, but it's based on messages being authenticated for mandrillapp.com, not your domain (ie, the Return-Path domain is being used for message authentication). In order to authenticate as your domain, and in turn pass the DMARC alignment check, you need both SPF and DKIM for the "from" domain. Here's information about the DKIM record to add: http://help.mandrill.com/entries/22030056-How-do-I-add-DNS-records-for-my-sending-domains-

Once you do that, the Mandrill account owner (in your case Flywheel), will need/want to validate those records in Mandrill, so that Mandrill knows both are valid and can start signing messages for your domain (this can be done within the account or via the Mandrill API).


The issue is caused by inconsistent between return-path and header From:.

Return-Path: mandrillapp.com

From: @seesawsf.com

  • SPF and DKIM check the domain using RFC5321.MailFrom (generally Return-Path:)
  • DMARC checks the domain using RFC5322.MailFrom (header From:)

Ref: https://space.dmarcian.com/how-can-spfdkim-pass-and-yet-dmarc-fail/

If the domain is different, DAMRC cannot authenticate the sender event though SPF and DKIM are passed and the authentication will be failed.

In this case, SPF and DKIM authenticate mandrillapp.com not for seesawsf.com.

As a workaround, Retrun-Path and Header From are needed to be the same domain or DMARC will be failed.


Domain-based Message Authentication, Reporting & Conformance (DMARC) is being adopted by many major email providers like Google, Yahoo, Hotmail, AOL and others. As can be read about here, it's aimed at standardizing email authentication through SPF and DKIM mechanisms already being used by most mail servers.

Adding a DMARC policy record is very similar to adding SPF and DKIM records: you would add a TXT record to your domain's DNS table using the tags listed here by Google. An example they provide is:

v=DMARC1; p=none; rua=mailto:postmaster@your_domain.com

Checking the DNS records for your domain, I see there hasn't been a DMARC record added yet:

v=spf1 +a +mx include:_spf.google.com include:servers.mcsv.net include:spf.mandrillapp.com -all

Details on how to add a TXT record for Mandrill and common DNS Providers can be found here.

  • I do have a DMARC record at _dmarc.seesawsf.com: "v=DMARC1; p=quarantine"
    – nielsbot
    Feb 2, 2015 at 17:51
  • 1
    @nielsbot It didn't show up when I tested it here. We typically don't trouble-shoot issues specific to a site or application, which is why I generalized the question and answer. It looks like you've got a specific answer from the source however (also pointing to the link in my answer). Good luck.
    – dan
    Feb 3, 2015 at 5:22

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.