My Waitlist Emails Passed SPF and DKIM but Failed DMARC

Vesprit is an application that predicts what users are about to forget and reminds them before it is too late. The author wrote about a bug in the waitlist feature that caused emails to end up in spam. Despite passing SPF and DKIM checks, the emails failed DMARC authentication. The author initially blamed the email content and email propagation, as well as a new sending address, but the root cause was that the domain used in the 'From' header was different from the authenticated domain.

DMARC authentication requires the 'From' domain to match the authenticated domain, and in this case, Gmail was sending from its own address, gmail.com, which did not match the Vesprit domain. The DMARC policy was set to monitoring mode, meaning that Gmail did not actually block the emails, but the failure was still reported. The author fixed the issue by using a domain they controlled in the 'From' header, ensuring alignment between the authenticated domain and the 'From' domain.