DNS Authentication DMARC Fail: The Mimecast Fix | DMARCguard Skip to main content<br>15 min read Share

“DNS Authentication: DMARC Fail” in Mimecast: What It Means and How to Fix It<br>“DNS Authentication: DMARC Fail” is the held-reason string Mimecast records when an inbound message’s From domain fails DMARC — neither SPF nor DKIM both passed and aligned with the visible From address — and the configured action (default: “Honor DMARC Record”) held or rejected it.<br>This guide serves both seats. If you administer Mimecast and inbound mail is being held, start at diagnosing the hold in the console. If your outbound mail is failing at Mimecast-protected recipients, jump to the sender-side fix. For failure causes that aren’t Mimecast-specific, start with the general checklist in why DMARC fails and how to fix it — this guide covers the Mimecast-specific path.<br>Either way, the fix starts in the message’s Authentication-Results header: dkim=fail (body hash did not verify) points to content modified in transit, while spf=pass with dmarc=fail points to an alignment gap. Fix the sender’s alignment at the source, or add a tightly scoped DNS Authentication exception — never a blanket Permitted Sender, which does not bypass DMARC. And take your time: held mail is retained for 14 days and releasable by an administrator, so nothing is lost while you diagnose.<br>What Does “DNS Authentication: DMARC Fail” Mean in Mimecast?<br>A DMARC fail in Mimecast is an inbound gateway verdict , not a bug report. It appears in the Administration Console under Message Center | Held Messages, in the Held Reason column, whenever a DNS Authentication - Inbound policy evaluates DMARC for an arriving message and the result is Fail (Mimecast KB article 34000340541587, updated 2026-04-22).<br>The string often carries a parenthetical sub-result, and decoding it is where most troubleshooting time is won or lost:<br>Held reasonWhat it actually saysDNS Authentication: DMARC Fail (SPF: ALLOW / DKIM: UNKNOWN)SPF passed but for a domain that doesn’t align with the From domain; DKIM was absent or unverifiable. DMARC fails on alignment.DNS Authentication: DMARC Fail (SPF: DENY / DKIM: ALLOW)SPF failed outright; DKIM verified but its d= domain doesn’t align with the From domain.DNS Authentication: SPF Fail / DNS Authentication: DKIM FailSeparate held reasons entirely — the single-protocol checks, logged distinctly from the DMARC verdict.

Decoding Mimecast's DMARC held-reason strings The recommended action for a DMARC Fail result is Honor DMARC Record , which defers to the sender’s published policy: p=quarantine sends the message to the Hold for Review queue, p=reject rejects it in-protocol. That means the hold is often correct behavior — the sending domain asked receivers to quarantine unaligned mail, and Mimecast complied.<br>Two operational facts shape your response window. Held messages remain in the queue for 14 days before they expire and are archived (Mimecast KB “Held Messages - Monitoring”, updated 2025-02-26). And a DMARC-failed hold is released by an administrator — end-user Personal On Hold covers spam, attachment, and content-examination holds, not DNS Authentication. Mimecast’s Personal Portal documentation and the University of Sussex ITS FAQ 2975 both reflect this split, so route release requests to an admin rather than telling users to check their personal hold queue.<br>Alignment itself is defined by RFC 9989 (DMARCbis, published May 2026, which obsoletes RFC 7489). Relaxed alignment is the default: the authenticated domain and the From domain need only share an Organizational Domain, determined since DMARCbis by a DNS Tree Walk rather than the Public Suffix List (RFC 9989 §3.2.10, §4.10). The mechanics of how DMARC evaluates SPF and DKIM alignment are unchanged by Mimecast — the gateway is just the referee.<br>Legitimate mail fails this referee more often than admins expect.<br>Key finding 38% / 29% / 14% of DMARC-failing legitimate mail traces to SPF misconfiguration, forwarding and mailing-list breakage, and DKIM key or selector issues, respectively<br>Source: DMARC Report, analysis of 1.2 billion messages across 2,400 domains, Q1–Q2 2025<br>An inbound message hits the DNS Authentication - Inbound policy; on a DMARC Fail, the configured action — Honor DMARC Record by default — decides between Hold for Review, Reject, and Deliver. How Do I Diagnose a DMARC Hold in the Mimecast Console?<br>Diagnosis in Mimecast DMARC troubleshooting takes two console stops, then one header read. The held message is retained and releasable throughout, so you can work through this in order.<br>Message Center → Held Messages. The Held Queue tab groups messages by held reason; confirm the reason is the DMARC string and not the separate SPF or DKIM strings.<br>Message Tracking → Message Details → Analysis tab. Per Mimecast’s documentation, the Analysis tab “shows the processing steps and provides the results of how an email has been assessed at each stage” (Mimecast KB “Message Tracking - Analysis...