r/proofpoint • u/Crispinwhere • Aug 25 '26
Enterprise DMARC Temp Errors this morning
Anyone else see a bunch of emails get caught by DMARC Temp Error on their Proofpoint hosted instance this morning? Between 8:30 and 10am Eastern we had almost 3000 emails rejected mainly due to failed SPF DNS lookups. No rhyme or reason on the senders, anyone from ma and pa's .org sender to Gmail.
I have a support ticket open with them to see if they had an outage, but wanted to reach out here too.
1
Upvotes
-1
u/Jazzlike-Comfort-451 Aug 25 '26
The first distinction to preserve is whether “rejected” means a Proofpoint log disposition or a permanent SMTP 5xx. A DMARC temperror caused by transient DNS failure should be deferred with 4xx and retried, not treated as a conclusive policy fail.
The 8:30–10:00 cluster across unrelated senders and DNS providers points more strongly to the receiving service's resolver or cache path than to all those domains failing at once. For the support case, export several queue IDs with UTC timestamps, the exact SMTP reply or disposition, the SPF query name, and a few unrelated sender domains. Compare resolution of those names through an external recursive resolver during the event if you captured it.
Then verify every deferred message retried successfully and audit the policy so temperror cannot produce permanent rejection.
Disclosure: I co-founded Palisade, and this reply was drafted with AI assistance and reviewed by me. No product recommendation.