Why is your email getting flagged by DKIM_ADSP or DMARC in SpamAssassin?

You send emails. They don’t land in the inbox. Instead, they get tagged as spam — not because of content, but because of authentication. Your DMARC policy says "reject", your DKIM signature says "I’m not sure", and SpamAssassin notices the mismatch. That’s when X-Spam-Status hits on DKIM_ADSP or DMARC rules start showing up.

This isn’t about a single misconfigured header. It’s about the interplay between your authentication policies and how receiving servers interpret them. If your DKIM alignment fails but your DMARC policy is set to reject, the receiving server sees a conflict — and punishes your sender reputation. Understanding why this happens is the first step to fixing it.

Key takeaways

  • SpamAssassin flags X-Spam-Status hits when DKIM signature alignment doesn’t match your DMARC policy
  • DMARC policy set to reject will block emails when DKIM or SPF alignment fails, even with valid authentication
  • Custom DKIM_ADSP settings can trigger false positives if not aligned with actual domain policies

What does X-Spam-Status: Yes mean when DKIM_ADSP or DMARC rules trigger?

The X-Spam-Status: Yes header appears when your email fails DKIM_ADSP or DMARC checks during server authentication. This means your domain’s published policy (via DNS) either conflicts with your actual email authentication, or your email didn’t meet alignment requirements under DMARC, even if SPF or DKIM passed individually. You’re likely being flagged for misalignment or policy violations — not just spam. Let’s break down what’s happening.

Differentiating DKIM_ADSP and DMARC Violations

DKIM_ADSP (DomainKeys Identified Mail - Automatic Detection of Sender Policy) activates when your domain has a published ADSP record — which declares whether you send mail using DKIM — but the message lacks a valid DKIM signature or the signature doesn’t match the domain listed in the ADSP policy. If you declared “policy=reject” or “policy=discard” via ADSP but your email isn’t signed, the server marks it as suspicious. This is rare in practice but serious when triggered.

DMARC rules fire when your domain’s DMARC policy is set to reject or quarantine (not just monitor), yet the email fails either SPF alignment or DKIM alignment. Even if SPF passes technically, if it doesn’t align with the “from” domain (e.g., you send from @yourcompany.com but SPF checks the subdomain @mail.yourcompany.com), DMARC fails. Similarly, DKIM alignment requires the signing domain to match the “from” domain.

Why This Matters for Deliverability

When DMARC or DKIM_ADSP triggers a X-Spam-Status: Yes, most receiving servers won’t deliver the message — they’ll either reject it outright or drop it into the junk folder. This is by design. You’re not being blocked for content; you’re being blocked for identity misrepresentation.

Common causes include: using a third-party sender (like SendGrid or Mailchimp) without properly aligning the signing domain with your “from” address; misconfigured SPF records; or not signing every email with DKIM when your domain’s policy demands it.

You can test this before sending by verifying your email headers and alignment using tools like MXToolbox or RFC 7483. Check your DNS records and verify that your sending domains match your from domains. For bulk senders, running a thorough email list check via MailTester’s bulk verification can catch invalid or misaligned addresses before they hurt your reputation.

If you're unsure whether your domain is correctly configured, use MailTester’s inbox placement test to see how your message lands in real inboxes across providers like Gmail, Yahoo, and Outlook. The results will show if DMARC or DKIM alignment is failing in practice.

How DKIM_ADSP_custom_med affects DMARC and SpamAssassin scoring

When your domain lacks a strict DMARC policy—or uses one that allows non-aligned messages—SpamAssassin marks emails with X-Spam-Status: DKIM_ADSP_custom_med. This flag reduces sender trust, even if SPF and DKIM pass, because it signals you haven’t committed to rejecting unaligned messages. The absence of a strong policy increases the risk of your messages being treated as suspicious or low-reputation.

What DKIM_ADSP_custom_med means in practice

DMARC uses DKIM_ADSP_custom_med to evaluate whether your domain has published a policy that allows automated handling of non-aligned messages. If your DMARC policy is missing, set to none, or too permissive, SpamAssassin interprets this as a lack of governance—especially when you send high-volume or promotional emails.

Even if your DKIM signature is valid and aligned, a DKIM_ADSP_custom_med result can still trigger SpamAssassin’s spam scoring. This isn’t a technical failure; it’s a trust signal. Without a clear policy stating you will not accept unaligned messages, recipient systems assume you don’t enforce sender standards—making your emails more likely to land in spam folders.

How to fix it without overcomplicating your setup

Let’s be clear: you don’t need to use reject on every message. But you should have a published DMARC record with a policy that rejects unaligned messages when possible—ideally rua=mailto:[email protected] and a policy set to reject or quarantine on alignment failures.

If your domain currently has no DMARC policy or uses none, consider moving toward quarantine in monitoring mode first. Check your current DMARC alignment and policy status using tools like dmarcian.com or MXToolbox to verify alignment and policy enforcement.

Most importantly, use a service like MailTester’s bulk verification to clean your email list regularly. Invalid or low-trust addresses can skew sender reputation, and even a well-configured DMARC policy won’t fully protect your deliverability if your list contains disposable or malformed addresses.

Fixing the root causes—weak policies, poor list hygiene, and unaligned DKIM—doesn’t require complex setup. It just requires checking what’s already in place and making one firm, deliberate choice: do you want to accept messages that don’t match your domain identity? If not, publish a policy that says so.

The real reason DKIM ADSP checks fail and how to fix it

DKIM_ADSP checks fail when a domain’s DNS lacks a published ADSP policy or when the policy contradicts the domain used to sign the email. If your domain signs emails with DKIM but has no ADSP record, SpamAssassin treats the sender as unverified, increasing spam risk. To fix this, publish a clear DKIM_ADSP policy or align your DKIM selector domain with your sending domain.

Why ADSP matters in spam filtering

SpamAssassin uses DKIM_ADSP (DKIM Adaptive Sender Policy) to validate whether a domain has formally declared its signing practices. If your domain signs emails with DKIM but has no ADSP record, the system assumes the signature might be forged. This is common in environments with automated email flows or misconfigured senders.

ADSP policies are published in DNS as TXT records under _adsp._domainkey.yourdomain.com. The value can be all, discard, or no, indicating whether all DKIM-signed emails from that domain are valid, should be discarded, or are not authorized. Without it, the absence creates uncertainty—SpamAssassin flags it as a red flag.

How to fix your DKIM_ADSP failure

Let’s walk through the fix. First, check if your domain has an ADSP record. Use a DNS lookup tool like MXToolbox or DNS Survey to query _adsp._domainkey.yourdomain.com. If no record exists, you need to publish one.

If you use a DKIM selector like default._domainkey, make sure the selector domain matches your sending domain. Mismatched selectors (e.g., signing with prod._domainkey.company.com from [email protected]) trigger ADSP failures even if DKIM passes.

Once you’ve confirmed alignment, publish the correct policy: all if you authorize all DKIM signatures, discard if you want receivers to treat unauthorized ones as spam, or no if you don’t use DKIM. After publishing, wait 24–48 hours for DNS propagation.

Use inbox placement testing to validate that your emails now pass checks after updates. This step confirms whether your fix resolved the X-Spam-Status hits related to ADSP or DMARC alignment.

For bulk checks across your list, ensure every sending domain has a consistent, correctly aligned policy. You can use MailTester’s bulk verification to spot domains with inconsistent or missing ADSP records before sending.

DMARC rejection without SPF or DKIM alignment: What to do

If your DMARC policy is set to p=reject, but either SPF or DKIM alignment fails, your emails will be rejected—even if the sender is legitimate. This commonly happens when your email service sends from a different domain than your branded domain, breaking alignment. Fix it by confirming your sending infrastructure aligns with your DMARC policy, or relax your policy to p=quarantine until all systems are properly aligned.

Why alignment fails in practice

You might think you’ve set up SPF and DKIM correctly, but DMARC checks alignment between the From: domain and the domains used in SPF or DKIM. If your email provider sends from mail.servicename.com but your branding is youcompany.com, alignment fails unless both are properly matched in the authentication records. This is why many brands using third-party email platforms hit DMARC rejection unexpectedly.

DMARC alignment is enforced via asp=relaxed or asp=strict (default is relaxed), and DKIM uses d= matching. If the d= domain in DKIM doesn't match the From: domain, or if the SPF sender domain doesn't match the From: domain under strict alignment, DMARC fails—triggering rejection when p=reject is in force.

How to resolve it step-by-step

Let’s walk through the fix: first, check your DMARC record at MXToolbox or dmarcanalyzer.com to confirm which alignment check is failing. If both SPF and DKIM fail alignment, you’re in trouble. If only one fails, it might be the stricter policy causing it.

Next, ensure your email service (like SendGrid, Mailchimp, or HubSpot) uses the same domain in its sending setup as your branding domain—or configure it to use a subdomain that aligns correctly. For instance, if your brand is youcompany.com, use mail.youcompany.com as the SPF and DKIM sender domain. Otherwise, your DMARC policy is effectively broken.

Set sp=reject only if you’re certain all sending sources and authentication are aligned. Otherwise, use p=quarantine while auditing. This gives you time to fix misconfigurations without breaking deliverability.

Use MailTester’s inbox placement tool to test how your email performs across providers with real-world feedback. Or verify your entire list with bulk verification to catch invalid or poorly configured domains before sending.

Step-by-step: Validate your DKIM and DMARC setup with MailTester

If your email is triggering X-Spam-Status hits on DKIM_ADSP or DMARC rules, it usually means your authentication setup is misaligned or incomplete. Use MailTester’s real-time API to test individual emails and inspect the full X-Spam-Status output. Check for missing, incorrect, or unaligned DKIM or DMARC records in your DNS. Fix any issues before resending to avoid delivery failures or spam filtering. This step prevents inbox placement problems and protects your sender reputation.

  1. Go to MailTester.com and test a single email via the real-time verification API. Use MailTester's Email Verification API to send a test email address. This simulates how your email would be received and analyzed by mail servers, including checks for DKIM and DMARC alignment.
  2. Examine the X-Spam-Status header in the API response. Look for lines like DKIM_ADSP or DMARC with a FAIL or NEUTRAL status. These indicate where authentication failed — often due to missing or incorrect DNS records.
  3. Review the full authentication trace from MailTester. The trace shows the signing domain, DKIM selector, and whether alignment between the From domain and DKIM/SPF domains matches. Misalignment is a common reason for DMARC failures. You can find detailed guidance on how SPF, DKIM, and DMARC interact in the IETF's DMARC specification.
  4. Run a bulk verification to detect widespread issues. Use MailTester’s bulk verification tool on your entire list. It will flag all addresses impacted by DKIM or DMARC failures, helping you prioritize fixes across high-volume sends.
  5. Correct misaligned or missing DNS records. Update your DNS with the correct DKIM selector, public key, and DMARC policy. Ensure the domain in the From header aligns with the domain used for DKIM signature and SPF. Once updated, re-test with the API to confirm resolution.

Why alignment matters

Even if DKIM passes, DMARC can still fail if the From domain doesn't align with the DKIM signing domain. This mismatch triggers a DMARC reject. Alignment is a key part of ensuring your emails are trusted and deliverable.

Next steps after fixing

After correcting your DNS setup, verify delivery with an inbox placement test before sending to your full list. Use MailTester’s inbox placement tool to see how your emails land across major providers. This confirms your fixes worked and protects long-term deliverability.

How to test inbox placement with MailTester before sending

You can test inbox placement with MailTester’s inbox tester before sending by simulating delivery to Gmail, Outlook, Yahoo, and other major providers. It checks if your DMARC or DKIM_ADSP violations trigger spam filters early, so you catch alignment issues before they hurt deliverability. Use it to see how your messages are filtered across providers and fix problems before your campaign runs. Learn more about email authentication standards at RFC 7489 (DMARC) and RFC 6373 (ADSP).

Simulate real delivery across major email providers

MailTester’s inbox placement test sends a real message to actual inbox environments—Gmail, Outlook, Yahoo, and others—using their public mail servers. This isn’t a simulation based on rules or proxies; it’s a real test under real conditions. You’ll see whether your message ends up in the inbox, spam, or is rejected outright.

Each provider evaluates your message based on SPF, DKIM, DMARC, and ADSP alignment. If your DKIM_ADSP policy is set but misaligned with your From domain, or if DMARC fails due to inconsistent authentication, MailTester flags it. The results show exactly where and why your message is being filtered—down to the specific rule failure like X-Spam-Status: Yes, DKIM_ADSP.

Compare results across providers to prioritize fixes

Not all email providers treat DMARC or ADSP the same. Gmail is strict on alignment but often allows some deviation in practice. Outlook can be more sensitive to SPF/DKIM mismatches. Yahoo, especially, can penalize missing or poorly configured ADSP tags.

By testing across providers, you can identify which alignment issues are causing real problems. For example, if Gmail accepts your message but Outlook sends it to spam due to a DKIM_ADSP violation, you know the fix should center on aligning your DKIM signature with the From domain. Use the inbox tester at MailTester inbox tester to run these checks in seconds.

Don’t guess—verify. Test your send environment before you send to 10,000 users. MailTester's inbox placement check reveals what your message actually hits, so you can correct alignment failures, catch invalid domains early, and maximize inbox placement. See how it works with real-time verification API or bulk list verification.

Common misconfigurations in SPF, DKIM, and DMARC that trigger X-Spam-Status

You’re seeing X-Spam-Status hits on DKIM_ADSP or DMARC rules because your email authentication setup has gaps: SPF includes outdated IPs or lacks a v=spf1 record, DKIM signs from an unverified selector or a mismatched domain, DMARC is set to p=reject without alignment, or the policy is missing or too lenient (p=none). Let’s fix each one.

SPF: Too many or wrong IPs, or no record at all

  • Ensure your SPF record starts with v=spf1 — a missing or malformed version tag breaks validation.
  • Remove or update IP ranges that no longer send mail. Overly broad or outdated includes (like ip4:192.0.2.0/24) can lead to alignment failures.
  • Limit includes to only trusted sources. More than 10 includes can break the SPF lookup limit, triggering fail states.
  • Use tools like MxToolbox to test your SPF record for validity and length.

DKIM: Selector or domain misalignment

  • Verify that your DKIM selector (e.g., default or mail) is publicly published in DNS via a TXT record.
  • Confirm the signing domain in DKIM matches the domain in the MAIL FROM (Return-Path) header — not just the From header.
  • Do not use DKIM unless you also align it with SPF, or DMARC will flag the message as potentially forged.
  • Use MailTester’s API to simulate sends and validate DKIM signatures across multiple recipients.

DMARC: Policy not enforced or misaligned

  • Do not set p=reject until both SPF and DKIM pass alignment checks. Applying it too early causes legitimate mail to be rejected.
  • Ensure your DMARC record is published at _dmarc.yourdomain.com with a valid policy.
  • A p=none policy does nothing — it only gathers data. You can’t enforce security without a real policy.
  • Align SPF and DKIM with the From header domain. Misalignment is a top reason for DMARC failures.
  • Monitor reports via DMARC Analyzer to identify domains or IPs sending mail without proper authentication.
Authentication isn’t just about checking boxes. It’s about ensuring consistent alignment across the full email path — from MAIL FROM to From header to DKIM signature.

Pro tip: Test before you send

  • Use MailTester’s Inbox Placement tool to simulate delivery through Gmail, Outlook, and other inboxes with real spam filters.
  • Run bulk email list verification via MailTester’s bulk verification to catch invalid or high-risk addresses before sending.
  • Set up integrations with your ESP (e.g., Mailchimp, HubSpot) to validate addresses in real time — not after the fact.

Why MailTester beats guesswork: real-time verification for DMARC/DKIM issues

When an email returns an X-Spam-Status hit on DKIM_ADSP or DMARC rules, it’s often due to misalignment or domain configuration issues. MailTester checks real-time DNS, MX records, and spam filtering behavior across major providers like Gmail, Outlook, and Apple Mail — not just static rules. It returns verified results (valid, invalid, catch-all, risky) and flags alignment problems in the response, so you know exactly what’s causing the rejection.

Real-time checks, not just theory

Most tools rely on outdated or incomplete data. MailTester sends test emails through real inboxes and monitors how they’re treated by systems like Google’s spam filters and Microsoft’s anti-abuse engines. This includes checking for DMARC policy violations, DKIM signature mismatches, and SPF alignment failures — the same checks that trigger an X-Spam-Status hit.

It’s not enough to confirm an address exists. You need to know if it will land in the inbox or be flagged. MailTester detects that by simulating actual delivery conditions across providers, including how DMARC and DKIM are enforced in real time.

Fix issues before you send, and avoid costly bounces

With a 98.9% accuracy rate, MailTester helps you avoid sending to addresses on domains with misconfigured SPF, DKIM, or DMARC policies. Misalignment between the "From" domain and the DKIM or SPF domains is a common reason for X-Spam-Status hits. MailTester surfaces these issues in the verification response, so you can filter out risky addresses before your campaign launches.

Let’s say you’re sending to a user with a domain that uses DMARC with a reject policy but has weak DKIM signing. MailTester will mark it as "risky" or "invalid" based on real delivery behavior — not just a static check. This prevents you from wasting sends on addresses that will be quarantined or blocked.

You can integrate MailTester with SendGrid, Mailchimp, HubSpot, or Klaviyo to pre-check your list before every send. It’s a fast, no-code solution that keeps your sender reputation intact. For developers, the real-time verification API lets you validate on the fly at scale.

Using real-world feedback from the major mailbox providers — including insights from RFC 7052, which defines DMARC’s reporting structure — MailTester gives you more than just a yes/no answer. It gives you actionable, precise feedback on why an address fails.

Learn how it works: bulk verify your list, integrate the API, or test inbox placement with real deliverability feedback.

Integrating delivery health checks into your workflow

You can reduce X-Spam-Status hits on DKIM_ADSP or DMARC rules by catching invalid or risky addresses early. Use real-time API verification for new sign-ups, run monthly bulk cleans, set policy-based alerts, and cross-check ESP delivery logs. This prevents bounces, blocks, and inbox failures before they hit your campaign stats.

Real-time onboarding validation

  • Integrate MailTester’s verification API at signup to catch invalid or disposable emails before they enter your system.
  • Let’s say a user provides an email like [email protected]—the API returns invalid or disposable in under 200ms, stopping delivery risks before they start.
  • For higher-risk domains (e.g. role accounts, catch-alls), use the verdicts to flag or suppress delivery, avoiding unnecessary sends.

Bulk list hygiene and policy monitoring

  • Run monthly bulk verification using MailTester’s bulk list verify to identify addresses that fail DMARC, DKIM, or SPF checks—key causes of X-Spam-Status hits.
  • Set up automated alerts for domains flagged with DKIM_ADSP or DMARC failures. These indicate policy misconfigurations that may trigger spam filtering.
  • Combine these results with your ESP’s delivery reports to isolate whether blocked sends are due to policy violations (like DMARC failure) vs. content or reputation issues.
  • Check RFC 7052 (the standard for DMARC) and learn how domains publish policies: tools.ietf.org/html/rfc7052—understanding this helps interpret your alerts correctly.

Most senders don’t check for DMARC or DKIM_ADSP issues until after they’ve been blocked. That’s reactive. You can be proactive—catching these early means fewer bounces, better sender reputation, and more consistent inbox placement. Use MailTester’s inbox placement testing (inbox-tester) to simulate real-world delivery across Gmail, Outlook, and other major clients.

Summary: Turn X-Spam-Status hits into deliverability wins

X-Spam-Status hits on DKIM_ADSP or DMARC rules reveal authentication misalignment. These are not false alerts — they signal that your email’s technical setup doesn’t match how receiving systems verify your identity.

Fix the root cause by ensuring SPF, DKIM, and DMARC records in DNS are consistent, correctly configured, and aligned across all domains and subdomains used in sending. Misalignment here directly impacts inbox placement.

Validate and maintain

  • Use MailTester’s real-time API or bulk verification to detect alignment issues before sending.
  • Check inbox placement across Gmail, Outlook, Yahoo, and others to confirm fixes resolve blocking.
  • Monitor your sender reputation over time — deliverability improves when technical policies match actual email behavior.

Sources

Keep reading

Ready to put this into practice? MailTester verifies emails with 98.9% accuracy — start with 100 free verifications.

Frequently asked questions

What does DKIM_ADSP_custom_med mean in SpamAssassin?

It indicates the domain has a custom ADSP policy that doesn’t align with the DKIM signature. This can trigger spam filtering if the policy allows non-aligned messages.

How can I fix a DMARC reject error on X-Spam-Status?

Ensure your SPF or DKIM alignment matches your DMARC policy. If using p=reject, confirm both authentication methods align with your sending domain.

Is DKIM_ADSP still relevant in modern sending?

Yes, DKIM_ADSP helps receivers determine whether a domain allows automated handling of non-aligned messages. A missing or conflicting policy can trigger filters.

Can MailTester detect DMARC policy conflicts?

Yes — MailTester checks DNS records and verifies if DKIM and DMARC alignment are consistent. It flags mismatches that could cause X-Spam-Status hits.

Why do some emails pass DKIM but still get flagged?

Because DKIM_ADSP or DMARC policies require alignment. Even if signed, if the domain in the signature doesn’t match the sender domain, a filter may flag it.

How does MailTester help with spam scoring?

It identifies email addresses and domains with alignment issues that trigger spam rules, including DKIM_ADSP and DMARC, before you send.

Do I need to fix every DMARC_ADSP rule hit?

Yes — even one hit can reduce inbox placement. Use MailTester to verify which addresses are safe and which need correction.

Can I test inbox placement with custom headers or SPF settings?

Yes — MailTester simulates delivery with real email providers, testing how your SPF, DKIM, and DMARC settings affect placement.

How often should I verify my list with MailTester?

Validate lists before every major send, and run bulk checks monthly to remove outdated or at-risk addresses.

Is MailTester’s accuracy realistic?

Yes — with 98.9% accuracy, MailTester provides reliable verification results for both individual and bulk email checks.