dmarc=fail (p=REJECT) in Authentication-Results

The receiver ran DMARC on your From domain, the check failed, and your policy of p=reject told it to refuse the message. The Authentication-Results header carries the whole diagnosis in one line: which checks passed, for which domain, and why none of them aligned. Read that line field by field before you change anything.

The line

Two passes and a failure. Nothing here is broken at the vendor, and nothing here helps you. Read it field by field.

• dkim=pass header.i=@vendor.net. The signature verified, for vendor.net. The domain that matters for DMARC is the signing domain d=, reflected here as header.i. It is not your domain, so it does not align.
• spf=pass ... smtp.mailfrom=bounces@vendor.net. SPF passed for the envelope sender domain, which is the vendor's. Also not your domain, also no alignment.
• header.from=example.com. This is the identity DMARC protects, and the reader sees it. Neither passing check matched it.
• p=REJECT. Your published policy, echoed back. sp=REJECT is what applies to subdomains.
• dis=NONE. The disposition actually applied. This message was delivered despite the policy, which is why you may be seeing failures with no bounces yet. Somewhere else, another receiver is applying dis=reject and you never hear about it except in aggregate reports.

What alignment requires

DMARC passes when at least one of these is true, with the default relaxed matching:

• SPF passes and the envelope sender domain is your From domain or a subdomain of it. So bounces.example.com aligns with example.com, and bounces.vendor.net never does.
• DKIM verifies and the signature's d= is your From domain or a subdomain of it.

Set aspf=s or adkim=s and the subdomain latitude disappears; an exact match is then required. The alignment guide works through the cases with real header examples.

Where to find the header

• Gmail: open the message, three dots, Show original.
• Outlook on the web: three dots, View, View message source.
• Microsoft 365: the same line plus compauth=fail reason=000, Microsoft's composite verdict. A compauth failure with everything else passing usually means alignment as well.
• Anywhere: send a message to a mailbox you control at a provider that writes this header. Gmail is the most readable.

Fix it

1. Identify the sender from smtp.mailfrom or header.i. That domain names the vendor.
2. Complete that vendor's domain authentication so it signs with d=example.com. This is the fix that also survives forwarding. The provider pages have the records for the common ones.
3. Set a custom return-path if the vendor offers one, which gets SPF aligned as well and gives you two passing paths instead of one.
4. Verify with the DKIM checker that the selector the vendor asked you to publish resolves, then send a test and read the header again. You want dkim=pass header.i=@example.com.

One header tells you about one message. Aggregate reports tell you about every sender at once, which is the only way to know you have found them all before you tighten a policy. Reading a report by hand is the next page to read, and our weekly digest does it for you if you would rather not.