Help Center
Help Center/Troubleshooting

Troubleshooting

Specific error messages and what to do about them.

Domain verification & DNS

  • "CNAME not found yet. DNS changes can take a few hours to propagate.": you just published a record and it hasn't resolved yet. Wait and retry; DNS propagation is commonly a few minutes to a few hours depending on your provider's TTL.
  • Domain verification fails in the Record Wizard. The wizard shows the exact hostname it looked up (_dmarc.{yourdomain}): double-check the record was added to that exact host, not the bare domain, and that there's only one _dmarc TXT record (a duplicate silently breaks DMARC parsing for most receivers). Use Retry, or go back a step to recheck the record value.
  • I published DMARC but see no data. DMARC aggregate reports typically arrive 24–48 hours after publishing. Confirm your rua= address points at DMARCS and check again the next day.

Authentication results

  • A sender shows as failing that I trust. Forwarded mail commonly fails SPF, which is expected. Check whether it passes DKIM; if DKIM aligns, DMARC still passes overall.
  • A certificate shows expired but it's valid. A host that hasn't finished its first scan can briefly display a placeholder state. Re-run the scan; if it persists, contact support.

SSO / SAML login errors

  • "SSO not configured for this organization": SSO hasn't been set up yet for your org; see SSO & Identity, or use /?manual=true to log in normally in the meantime.
  • "SSO assertion rejected: email domain does not belong to this organization.": the single most common SAML misconfiguration: your IdP is sending an email attribute that doesn't match your organization's domain. Check which SAML attribute your IdP maps to email and confirm it matches the user's real email address.
  • "SAML Auth Failed: ...": generally a certificate or signature mismatch between what your IdP sent and what DMARCS has on file. Re-upload your IdP's current Federation Metadata XML.
  • Metadata upload fails with "Failed to parse XML.": the file must be a well-formed SAML metadata document with an EntityDescriptor, an HTTP-Redirect SSO binding, and an X.509 certificate. Re-export it fresh from your IdP rather than hand-editing it.
  • Any OIDC token error ("Malformed id_token," "audience mismatch," "issuer not recognized," "token expired"): these all mean the identity token DMARCS received from your IdP didn't validate. Re-check the Tenant ID / Client ID / Client Secret you entered against your IdP app registration.
Emergency access: append /?manual=true to your dashboard URL any time SSO itself is the problem: this always forces the standard email/password login screen.

BIMI / logo & certificate uploads

  • "Security Violation: the SVG could not be parsed or contains disallowed content.": your logo file has script tags, event handlers, or external references that get stripped for safety; re-export a clean SVG (Tiny PS profile) from your design tool.
  • "Invalid VMC file: expected a PEM-encoded certificate.": the VMC upload must be the actual PEM certificate file (not a zip, not a .crt in another encoding), and under 512KB.

Rate limits

  • 429 "Too Many Requests" in the app itself means you've hit an internal action limit (these reset on a rolling window (a minute or an hour depending on the action), e.g. PDF report generation or vendor scans). Wait for the Retry-After period and try again; it's a protective limit, not an error in your data.
  • 429 on the Public API means you've exceeded 300 requests/minute for that API key; back off and retry after the Retry-After header's value.
  • 503 "Rate limiting temporarily unavailable" on the API is a rare infrastructure hiccup on our side, not a client problem; retry shortly.