My DMARC is rejecting my own mail.

Why this is hard to notice

The rejection happens on the receiving side. Your outbox says sent. There is often no bounce, because the receiving server accepted the message and then discarded or quarantined it. The only symptom is that people stop replying.

Find the failing sender

• If you have a rua address in your DMARC record, reports are already arriving. They are XML and unpleasant to read directly; any DMARC report reader will summarise them.
• The reports list every source sending as your domain, with pass and fail counts. The failing ones with real volume are your own tools.
• Common culprits: invoicing and accounting software, booking systems, CRM, help desks, marketing platforms, and anything that emails customers on your behalf.
• If no reports exist, add rua=mailto:you@yourdomain.com and wait a few days before changing anything else.

Then fix it properly

• For each legitimate sender, follow their instructions to authorise it: usually an SPF include and a DKIM record they give you.
• Watch until that source shows as passing in the reports.
• If mail is being rejected right now, move the policy back to p=none while you work. Delivery matters more than the policy in the meantime.
• Once everything legitimate passes, tighten back to quarantine and then reject.

Watch the lookup count

Authorising senders adds SPF includes, and SPF has a hard limit of ten DNS lookups. Cross it and the entire record fails while still looking correct. See that guide before adding your fifth or sixth include.

For the full picture including alignment: the DMARC field guide.