- A legitimate email is blocked because the sender does not provide proper authentication
- SPF or DKIM is correct, but the email is not marked as authentic
| Situation | Explanation | Measures |
|---|---|---|
| Sender has valid SPF but is not marked authentic | Usually, the envelope from domain (used for SPF) differs from the header from domain, which breaks DMARC alignment. | Ask the sender to use the same domain for both. If that’s not possible, configure a Trusted MTA in xorlab to override authentication. |
| Email has a valid DKIM signature but is not marked authentic | Usually, the DKIM signing domain is different from the header from domain, which breaks DMARC alignment. | Ask the sender to sign with the same domain as the header from. If that’s not possible, use a Trusted MTA configuration. |
| SPF/DKIM failed, but the email was not blocked | A failing SPF or DKIM alone is not enough to block an email, as this also happens with legitimate mail. However, it is still treated as a negative signal and increases the chance of blocking. | If you want to block all such emails, create a campaign based on the #dkimfail and #spffail tags. |
| Email passes SPF/DKIM but is still blocked | Authentication only proves that the email was actually sent from the sender domain, not that the email is safe. Attackers can still send from valid domains. | Create a campaign, or add the sender to the Low trusted sender addresses list (Trusted Senders and Infrastructure) to make sure the email is not blocked. |