Blog · Dmarc
Why DMARC Fails When SPF and DKIM Both Pass
You run an email authentication check and get this result:
- SPF: pass
- DKIM: pass
- DMARC: fail
Your first reaction is that something is broken. It is not. The two checks are doing different things, and DMARC failing while SPF and DKIM pass is one of the most common sources of confusion in email authentication.
The short explanation: SPF and DKIM verify WHO sent the mail. DMARC verifies that the visible sender domain matches. Authentication can pass. Alignment can still fail.
The two sender identities in every email
Every email has two sender domains that matter for authentication.
The first is the envelope sender domain, also called RFC5321.MailFrom. This is the domain your mail server uses during the SMTP conversation. It determines where bounces go. It is what SPF authenticates when it runs.
The second is the header From domain, also called RFC5322.From. This is the domain shown in the From header that recipients see in their email client. It is what DMARC protects.
These two domains do not have to be the same. In fact, it is normal for them to differ when you use a third-party email service, a marketing automation platform, or almost any mailing infrastructure beyond your own mail server.
What DMARC alignment actually checks
When DMARC runs, it performs two separate checks:
1. Authentication: SPF and DKIM run first. They verify that the envelope sender or DKIM signing domain is authorized to send mail for that domain.
2. Alignment: DMARC then checks whether the RFC5322.From domain aligns with the domain that just authenticated.
For DMARC to pass, the authenticated domain must align with the visible From domain. The exact rules depend on the alignment mode.
Strict vs relaxed alignment
DMARC has two alignment modes, set in your DMARC record with the p tag.
Relaxed alignment (aspf=r): the organizational domains must match. A subdomain of example.com is considered to align with example.com. This is the default and works for most legitimate configurations.
Strict alignment (aspf=s): the domains must match exactly. A subdomain does not align with the root domain, even if it is the same organization.
If you use strict alignment and your RFC5322.From is newsletters@example.com while your SPF verifies example.com, DMARC fails. Relaxed alignment would pass in that scenario.
Why alignment fails in practice
Here are the most common real-world reasons you see SPF pass, DKIM pass, and DMARC fail.
Email forwarding
When a message is forwarded, the envelope sender usually changes to the forwarder's server. The original RFC5321.MailFrom is lost and replaced. SPF now authenticates the forwarder's domain, not yours. The From header still shows your domain. The domains no longer align. DMARC fails.
This is why forwarding and DMARC are inherently difficult to combine. Forwarders that rewrite the envelope sender break alignment by design.
Third-party email services
If you send transactional email through SendGrid, marketing mail through HubSpot, or product notifications through your SaaS vendor, those services send from their own infrastructure. The envelope sender is their domain. The From header is your domain. SPF authenticates their domain. Alignment with your domain fails.
This is why you need to configure DKIM signing with your own domain at the third-party service. DKIM signatures are tied to the signing domain, which you control. If the third-party DKIM signature uses your organizational domain, alignment passes even though the envelope sender belongs to the service.
Subdomain misalignment
If your DMARC policy applies to sub.example.com but your SPF record is on example.com and your From header shows example.com, alignment fails under strict mode. The domains are different organizational levels.
This is a common misconfiguration when DMARC is applied to parent domains but individual teams run services on subdomains without corresponding SPF and DKIM records.
Multiple email channels
Organizations often have different systems sending mail for the same From domain. Your CRM sends from crm.example.com. Your marketing platform sends from mail.example.com. Your product sends from noreply@example.com. Each one has a different envelope sender and different authentication. If any of them does not have matching DKIM or aligned SPF, DMARC fails for that source.
This is why DMARC aggregate reports are essential. They show you every source sending as your domain and whether each one passes or fails alignment.
How to diagnose alignment failures
The fastest way to see which sources are failing alignment is a DMARC aggregate report. Aggregate reports arrive at the RUA address in your DMARC record and show a breakdown of every sending source for your domain, organized by result.
Look for entries where:
- The source IP is authorized by SPF for a different domain
- DKIM signatures use a domain that does not match your From domain
- The envelope sender domain differs from your organizational domain
These are your alignment failures. A single misconfigured forwarding rule or third-party service can generate thousands of alignment failures per day.
If you do not have an RUA endpoint configured, you are flying blind. Setting one up should be the first step before trying to fix alignment problems.
Without a tool that parses and visualizes these reports, you have to decode the XML yourself for every source. DMARCFlow processes your aggregate reports automatically, maps each source IP to its sending system, and flags which ones are producing alignment failures. This turns a manual debugging session into a targeted fix list.
How to fix alignment failures
For each failing source:
1. Third-party sending services: set up DKIM signing with your own domain at the service. Most major providers support custom DKIM domains. This makes DKIM authentication use your domain, which aligns with your From header.
2. Forwarding problems: there is no universal fix. You can use ARC (Authenticated Received Chain) to preserve original sender information through forwarding chains, but not all receivers support it. In some cases, the only option is to use a subdomain exclusively for forwarding-prone addresses.
3. Subdomain mismatches: either add SPF and DKIM records for each subdomain, or ensure your From addresses use the same domain that your authentication records cover.
4. Multiple sending systems: consolidate sending infrastructure where possible. For systems you cannot consolidate, configure DKIM for each one with your organizational domain.
FAQ
Does passing SPF mean my domain is safe from spoofing?
No. SPF only verifies the envelope sender. An attacker can send mail with your domain in the From header while sending from any server they control. SPF alone does not stop impersonation. DMARC alignment is what ties the visible From domain to authenticated sending infrastructure.
Can DMARC fail even with valid SPF and DKIM records?
Yes. This is the alignment problem. If your RFC5322.From domain does not align with the domain authenticated by SPF or DKIM, DMARC fails regardless of whether those checks individually pass.
Does relaxed alignment make DMARC weaker?
Relaxed alignment is the default and is appropriate for most organizations. It allows legitimate subdomain variation while still preventing exact domain spoofing. Strict alignment is more secure but requires precise configuration of every sending source.
Can I use DMARC without DKIM?
Yes. DMARC can operate with SPF only, DKIM only, or both. Using both provides defense in depth. If either alignment check passes, DMARC passes.
Tracking alignment across every sender
Once you have diagnosed the failure modes, the ongoing challenge is monitoring all your sending sources for alignment regressions. New third-party integrations, additional marketing platforms, or changes to your own mail infrastructure can introduce new alignment failures without warning.
DMARCFlow monitors your aggregate reports continuously and alerts you when new sources appear or when alignment failure rates spike for existing sources. This gives you a running view of which systems are sending as your domain and whether they are doing so cleanly.
---
The confusion between authentication and alignment is so common that it has its own FAQ section in the DMARC RFC. SPF and DKIM are authentication mechanisms. DMARC adds alignment checking on top. They are designed to work together, and understanding why they are separate is the key to diagnosing failures correctly.