The DMARC Delivery problem

Some senders publish a strict DMARC policy (set to reject or quarantine). When this happens, clean messages may be rejected by your mail server because the “From” address doesn’t align with the server delivering the message. This can impact mail delivery for messages from these senders.

Available solutions

Any of the following solutions can be used to resolve DMARC-related delivery issues:

• Whitelist SpamHero's IPs on your mail server so that email from SpamHero hosts is always accepted.
• Turn off the DMARC enforcement in your mail server configs. This is the recommended solution if you are able to restrict delivery to your mail server to SpamHero IPs only.
• Enable the DMARC delivery workaround option in the SpamHero control panel (found in Settings > Filtering policies). This option is recommended when the previous two options are not possible.

  Our system may automatically enable the DMARC delivery workaround if we detect that your mail server is rejecting messages with a DMARC related error.

The DMARC delivery workaround

When enabled, the DMARC delivery workaround will automatically adjust the message during the delivery process, when they meet the following conditions:

Conditions

• The original message successfully passed DMARC authentication
• The sender has a DMARC policy of reject or quarantine

Message adjustments

When the above conditions are met, the following changes are made to the message directly before delivery:

Technical overview

• The sender domain on the From line is switched to a domain that will not fail the DMARC check
  • The sender's name has via DMARC workaround appended for clarity
• If missing, a Reply-To header is added that points to the original sender's email address, so replies still go back to the right place.
• The Return-Path address is changed to one that will pass SPF checks
• All other original header lines remain unchanged

Recipient experience

• The message arrives authenticated under our forwarding domain, preventing DMARC-based rejections.
• The visible From line still shows who the original sender was, with a note that the DMARC workaround was applied.
• Replies go back to the original sender, not to the workaround address.

Is this the right solution?

If you are unable to whitelist the SpamHero's IPs on your mail server or turn off the DMARC enforcement then the DMARC Workaround is the best option at this time.

The DMARC Delivery Workaround can be toggled in the SpamHero control panel (found in Settings > Filtering policies).