DM000001: rejected by the sender's DMARC policy
Xfinity rejected the message because it passed neither SPF nor DKIM for the sending domain, and it applied that domain's published DMARC policy.
- Comcast
- Provider
- Sources checked
- Author
At a glance
- Code
- DM000001
- Provider
- Comcast (Xfinity)
- Who has to act
- The sender. The fix is on the sending side: your domain, your server or your list.
What it means
DMARC lets a domain owner publish what receivers should do with mail that uses the domain in its From address but fails authentication. Xfinity honours that policy. DM000001 says the message passed neither DKIM nor SPF for the sending domain, so Xfinity applied the domain's published policy and refused it. When the domain is yours, a likely cause is a sending service that is not authenticated for it, such as a newsletter tool or a CRM sending in your name. When the domain belongs to someone else, the message may be a forgery, which is what the policy exists to stop, or it may have been forwarded in a way that broke authentication.
Common causes
- A service sending in your name is not covered by your SPF record and does not sign with DKIM for your domain.
- DKIM signs with a different domain from the From address, so it does not count for DMARC.
- The message was forwarded or altered on the way, breaking SPF and DKIM.
- Someone forged the domain in the From address.
How to fix it
- 01Look up the domain's DMARC, SPF and DKIM records and identify which sending source failed.
- 02Add that source to SPF or, better, have it sign with DKIM using your domain.
- 03Use DMARC aggregate reports to find every source sending as your domain before tightening the policy.
- 04If you need more help, use Report an issue under Postmaster on Xfinity's Customer Security Assurance site.
Sources
What this page rests on, checked on 20 Oct 2026. The explanation is ours; the reply text is the server's.
Related codes
Further reading
All 33 Comcast codesEvery code in the wikiPaste your own bounce