A DMARC report can show which senders have SPF errors. Finding the cause still requires the domain used by those messages and the SPF record behind it.
A report can identify the symptom
A DMARC aggregate report groups messages seen by a receiving service. It can show that messages from a particular sending IP had an SPF error while others passed. That gives you somewhere to investigate, but the report itself cannot change the SPF record.
Aggregate reports are summaries from participating receivers. They do not trace an individual missing message through every mail server.
The result determines the next question
| Result in the evidence | What to investigate |
|---|---|
| SPF reports a permanent error | Invalid syntax, too many lookups, duplicate SPF records or a broken reference. The error alone does not identify which. |
| SPF passes, but DMARC fails | Whether the SPF domain aligns with the visible From domain, and whether an aligned DKIM signature passes. |
| SPF fails after forwarding, but aligned DKIM passes | Whether forwarding changed the sending server while preserving the signed message. |
DMARC can pass through aligned SPF or aligned DKIM. An SPF error and a DMARC pass can therefore appear on the same message. The alignment guide explains how to read those identities.
An example of a useful investigation
In this fictional example, staff email passes SPF while invoices from a separate service show a permanent SPF error. Both have passing, aligned DKIM signatures, so DMARC still passes.
The report helps identify the invoice sender. A received invoice or its delivery evidence then establishes the return-address domain actually checked by SPF. Inspecting that domain's record reveals that reaching the invoice provider requires an eleventh lookup. Staff email matches earlier and does not reach that step.
The SPF checker can inspect the published references. The lookup-limit guide explains how to assess the failing path and possible corrections. Automatic flattening can reduce supported lookup chains; it does not repair DKIM or change DMARC's alignment rules.
Use the report to check what happened next
After correcting the SPF policy, send a test from the affected application and inspect the receiving system's authentication results. Later reports can help show whether participating receivers continue seeing the error.
Use the DMARC report analyser to inspect an aggregate report you have received. Keep the reporting period in view: a report covering yesterday cannot establish whether today's DNS change worked.
Sources and further reading
- RFC 7208: SPF DNS lookup limits
- RFC 9989: DMARC
- RFC 9990: DMARC aggregate reporting
- Emailmetry: stated SPF safeguards
Sources reviewed 12 September 2026.