dmarc=fail

dmarc=fail means the domain in the From line publishes a DMARC record, but nothing on this message authenticated it. SPF and DKIM may each have passed for some domain, but neither passed for one that matches the From domain. The message is therefore either forged, or genuine mail that something altered on the way, or genuine mail sent through a service the domain owner never set up properly.

What the RFC says

RFC 9989 §9.2 defines fail as a DMARC record existing but no aligned authenticated identifier. §5.3.5 counts it as a fail both when nothing authenticated at all and when things authenticated but didn't align. What happens next is the receiver's decision (§5.3.6), guided by the domain's p= value: none, quarantine or reject (§4.7). §5.4 tells receivers not to reject solely because the policy says reject, so a failing message can still land in your inbox.

From: "Payroll" <payroll@example.com>
Authentication-Results: mx.example.org;
       spf=pass smtp.mailfrom=bounce.mailer.example.net;
       dkim=pass header.d=mailer.example.net;
       dmarc=fail (p=QUARANTINE dis=QUARANTINE) header.from=example.com

Both underlying checks passed here, but for mailer.example.net, not example.com. The analyser shows that mismatch as an alignment failure.

Causes, roughly by frequency

1. A legitimate service sending without alignment. A newsletter, HR or ticketing tool sends as the domain using its own bounce domain and DKIM domain, as in the snippet. This dominates aggregate reports.
2. Forwarding and mailing lists. Forwarding breaks SPF (RFC 7960 §2.2). A list that edits the body breaks DKIM. If an intermediary sealed the message with ARC, a receiver may accept it on that basis (RFC 8617 §7.2.1). Look for arc=pass.
3. Spoofing. Someone put the domain in From without access to its systems. This is exactly what DMARC exists to catch.

If you received this message

If the From domain is a bank, employer or service you deal with, and the Received chain shows no forwarding or list, treat the message as forged. Don't click, and don't reply. If it reached you through a list or a forwarding address, a fail is expected and says little.

If you own the domain

Your aggregate reports list every source failing for your domain. For each legitimate one, enable DKIM signing with your domain (custom domain authentication) or a custom bounce domain under yours. RFC 9989 §7.4 is blunt: a domain publishing p=reject must not rely on SPF alone and must sign with DKIM, because only DKIM survives forwarding. Note that the old pct= tag is gone (Appendix A.6). To soften a new policy while you test, the current standard uses t=y.