Why DMARC Alignment Breaks After a Platform Migration (And How to Fix It)

You switched your email platform. SPF is passing. DKIM is passing. Your DMARC reports show nothing but failures.

This is the alignment problem. It catches almost every team that migrates email infrastructure, and it is not obvious unless you know what to look for.

The Difference Between Authentication and Alignment

SPF and DKIM verify that an email came from infrastructure you authorized (SPF) and was signed with a key you published (DKIM). DMARC adds a second requirement on top: the domain in the RFC5322.From header must match the domain used in SPF and DKIM authentication.

This second requirement is alignment. Without it, someone could send mail through your authorized AWS IP range and spoof any From address they like. SPF would pass and DKIM might pass, but DMARC would block it because the From domain does not match the authenticated domains.

During a platform migration, alignment is what usually breaks.

Why Platform Migrations Break Alignment

A platform migration changes either your SPF setup, your DKIM setup, or both. Either change can break alignment even when both SPF and DKIM still pass individually.

SPF alignment breaks when your new platform sends from infrastructure that uses a different envelope-from domain than your From address. Many platforms use their own domain in the RFC5321.MailFrom, which may not match your RFC5322.From domain. If your previous platform handled this correctly and your new one does not, SPF alignment fails.

DKIM alignment breaks more often. Your new platform signs outgoing mail with its own DKIM key, using the platform's domain in the DKIM-Signature d= tag. Your From address is still yourdomain.com, but the DKIM signature now carries d=newplatform.com. DKIM passes, but DMARC sees the d= domain does not match your From domain and fails alignment.

These are two different problems. You cannot fix a DKIM alignment issue by updating your SPF record.

How To Diagnose Which Alignment Is Failing

Before fixing anything, read your DMARC failure reports. They tell you which alignment check failed and which source IPs are involved.

Look at the auth_results section in your DMARC aggregate report. It shows SPF result, DKIM result, and alignment status for each contributing IP. If SPF shows "pass" but alignment shows "fail," your SPF alignment is broken. If DKIM shows "pass" but alignment shows "fail," your DKIM alignment is broken. If both show pass with alignment fail, you have both problems simultaneously.

This is where a monitoring tool like DMARCFlow becomes practical rather than optional. Aggregate reports are XML.gz email attachments that are not designed to be read manually. DMARCFlow parses them and surfaces per-IP authentication results with alignment status, so you can identify which IPs are failing alignment and why, without decompressing and parsing XML files.

Fixing SPF Alignment After Migration

If your issue is SPF alignment, the problem is in the RFC5321.MailFrom domain. Your new platform is sending with an envelope-from address that does not match your From domain.

Some platforms let you set a custom envelope-from domain that uses your own domain. Check your platform's sending domain or RFC5321.MailFrom configuration. Setting this to your own domain resolves SPF alignment automatically.

If your platform does not allow custom envelope-from, or if you are routing mail through a service that rewrites the envelope-from, SRS (Sender Rewriting Scheme) may help. SRS adds a wrapper domain to the envelope-from that preserves the original sender while satisfying SPF alignment. Not all platforms or gateways support SRS, but it is worth checking whether yours does.

Also verify your SPF record covers your new platform's sending infrastructure. If you switched from Platform A to Platform B, your SPF record may still only list Platform A's IP ranges. Update it before cutover.

Fixing DKIM Alignment After Migration

If your issue is DKIM alignment, the problem is that your new platform signs with its own domain in the d= tag, not yours.

The fix is custom DKIM signing: configure your new platform to sign outgoing mail using your domain's DKIM selector, not the platform's default.

Your new platform should provide a DKIM selector and public key. You publish that key under your own domain's DNS, typically as selector._domainkey.yourdomain.com or similar. The platform then signs with your domain in the d= field.

If your platform does not support custom DKIM signing, DKIM alignment will never work with your domain. This is a legitimate disqualifier for enterprise deployments. Before choosing a new email platform, verify that they support custom DKIM signing with your domain in the d= field.

Once the DKIM record is published and your platform is configured correctly, send a test message and check your DMARC reports. Alignment should restore within the DKIM record's TTL window (typically minutes to 48 hours).

Preventing Alignment Failures Before Your Next Migration

1. Get a DMARC baseline before you migrate. Run a DMARC checker on your domain and save the alignment results. After cutover, compare to spot new failures immediately.
2. Verify custom DKIM signing is supported before signing with a new platform. If they only sign with their own domain in the d= field, DKIM alignment will never work for your domain.
3. Update your SPF record to include the new platform's infrastructure before cutover, not after. SPF propagation is not instant, and you want authentication working from day one.
4. Test with a subdomain first. Migrate one non-production domain, send test messages, check DMARC reports, and confirm alignment before moving production domains.
5. Monitor DMARC reports daily for at least two weeks after migration. Alignment problems that go undetected can result in legitimate mail being rejected by receivers running strict DMARC policies.

Quick Diagnosis Checklist

Use this when DMARC breaks after any infrastructure change:

• Run a DMARC checker before and after the change. Compare the alignment results side by side.
• Look at the DKIM-Signature header on an outbound message. The d= parameter must show your domain, not your platform's.
• Check your SPF record: dig txt yourdomain.com. Does it include all current sending infrastructure?
• Review DMARC failure reports for source IPs you do not recognize. Unfamiliar IPs often indicate a vendor or subprocess you did not account for in your SPF record.
• Confirm your new platform signs with your domain in the DKIM d= field. If it shows newplatform.com instead of yourdomain.com, DKIM alignment will fail for all messages.

FAQ

Why does DMARC fail when both SPF and DKIM pass?

SPF and DKIM are authentication checks. DMARC adds alignment, which verifies that the domains used in authentication match the From header domain. All three must pass for DMARC to pass. Authentication and alignment are separate checks.

How do I know if my SPF alignment is failing vs DKIM alignment?

Your DMARC aggregate report shows this. The auth_results block lists each IP that sent mail for your domain, with separate pass/fail and alignment results for SPF and DKIM. If SPF shows pass but alignment fail, the problem is SPF alignment. If DKIM shows pass but alignment fail, the problem is DKIM alignment.

Can I use the same DKIM key from my old platform on my new platform?

No. Your old platform's DKIM key is managed by them and published under their DNS. You cannot transfer it. Your new platform generates its own key pair. You publish their public key under your own domain's DNS. The new platform must support custom DKIM signing for this to work.

How long does it take for DKIM alignment to restore after fixing DNS?

DKIM TTLs vary by DNS provider. Once your DKIM record is published, it can take anywhere from a few minutes to 48 hours for all receiving servers to pick up the new record. DMARC alignment will restore once receivers have fetched the updated DKIM record and can verify the signature.

Should I use p=none during an email platform migration?

Yes. Set p=none before migration so you can monitor what breaks without blocking legitimate mail. Review your DMARC reports daily. Move to p=quarantine once you have confirmed alignment is restored and no unexpected sources are sending as your domain.

DMARC alignment failures after a platform migration are common and usually straightforward to fix. Most cases trace back to DKIM signing with the platform's domain instead of yours, which is a configuration issue on the platform side. SPF alignment issues are typically solved by using a custom envelope-from domain or updating your SPF record.

Ongoing monitoring matters here. Alignment drift does not announce itself with obvious errors. DMARCFlow parses aggregate reports automatically and surfaces alignment failures per IP, making it practical to catch migration-related problems on the day they appear rather than days later when mail has already been rejected.