Blog · Dmarc
Why DMARC Fails When SPF Passes: Alignment Explained
The Error That Confuses Every Email Admin
You have checked your SPF record. Your mail server is authorized. Messages send cleanly. Then you enable DMARC and your reports come back showing hundreds of failures. SPF shows pass. DMARC shows fail.
This is not a contradiction. It is a feature.
The confusion comes from assuming that SPF and DMARC are measuring the same thing. They are not. SPF checks whether the mail server is allowed to send for a domain. DMARC checks whether the domain in the message From: header matches the domain that sent the message. Both must be true for a full DMARC pass.
The second check is called alignment.
Authentication Is Not Alignment
SPF and DKIM are authentication mechanisms. They answer the question: is this mail server or signing key authorized for this domain?
DMARC adds a second question on top of authentication: does the From: header domain align with the authenticated domain?
Here is the key distinction:
- SPF pass: the mail server that received or delivered this message is listed in the domain's SPF record
- DMARC pass: in addition to SPF or DKIM passing, the domain in the message From: header matches the domain that passed authentication
A message can fail SPF and pass DMARC. A message can pass SPF and fail DMARC. Both are normal. Neither is a contradiction.
How DMARC Alignment Works
DMARC checks alignment for either SPF or DKIM independently. You do not need both to pass. You need at least one to pass AND align.
There are two modes:
Relaxed alignment allows the From: domain to be a subdomain of the authenticated domain. If example.com is authenticated, then newsletters.example.com passes relaxed alignment.
Strict alignment requires an exact domain match. sub.example.com does not align with example.com under strict mode.
The alignment mode is set in your DMARC policy record:
v=DMARC1; p=quarantine; rua=mailto:reports@example.com; sp=strict; adkim=r;
adkim=r means relaxed DKIM alignment. adkim=s means strict.
aspf=r means relaxed SPF alignment. aspf=s means strict.
Most organizations start with relaxed alignment for SPF because it is common to send from subdomains of the main domain.
Why Alignment Breaks: The Real Scenarios
Alignment failures fall into a few distinct patterns. Each has a different cause and a different fix.
Scenario 1: Multi-Provider Email Setups
You run Google Workspace for internal mail but use a marketing platform like Mailchimp or a CRM that sends from its own servers. The marketing email comes from a server that passes its own SPF check, but the From: header shows your domain. The authenticated domain (mailchimp.com) does not align with the From: header domain (yourcompany.com). DMARC fails.
This is one of the most common causes of DMARC failures that are not actually attacks.
Scenario 2: Email Forwarding
A recipient has their email forwarded to another address. The forwarding server becomes the new SMTP sender. SPF checks the forwarding server against the original domain and fails because the forwarding server is not listed. Even if SPF somehow passes, the From: domain (yourcompany.com) does not match the forwarding domain.
Forwarding is a known weak point for SPF. DMARC alignment catches forwarding-related failures because alignment checks the From: header, not just the SMTP sender.
Scenario 3: Third-Party Senders and Bulk Mailers
Your IT team sends from the main email system. Your marketing team sends from a separate platform. Your support software sends from its own infrastructure. Each system uses its own SPF domain or DKIM selector. Unless each sender's domain aligns with your From: header domain, DMARC fails.
Scenario 4: Domain Migrations and Platform Moves
You moved from Exchange to Google Workspace. Your SPF record updated. Your DKIM keys are published in Google. But old email routing rules or third-party integrations still send from the old platform with the old domain configuration. Alignment breaks during the transition because the sending infrastructure does not match the From: domain.
This is the specific problem described in one recent thread where alignment survived the initial setup but broke during a tool migration.
Reading a DMARC Failure Report
DMARC failure reports (RUF) arrive as XML. They contain the raw authentication results and the alignment check outcome for each message. Here is what to look for.
A DMARC failure report will typically show:
<row> <source_type>mtp</source_type> <count>1</count> <policy_evaluated> <disposition>none</disposition> <dkim>fail</dkim> <spf>pass</spf> </policy_evaluated></row><auth_results> <dkim> <result>pass</result> <domain>example.com</domain> <alignment>fail</alignment> </dkim> <spf> <result>pass</result> <domain>example.com</domain> <alignment>fail</alignment> </spf></auth_results>
In this example, both SPF and DKIM authenticated successfully. But the alignment check failed for both. The From: domain did not match the authenticated domain.
The key fields are inside : look for the element. If it shows fail, that is where your problem is.
If shows pass but shows fail, your DKIM signing is working but the signing domain does not match your From: header domain. This is common with third-party senders.
If shows pass but shows fail, your SPF is correct but the envelope sender domain does not match your From: header.
How to Fix Each Failure Mode
Fixing alignment failures requires matching your sending infrastructure to your From: domain.
If DKIM alignment fails: make sure your third-party senders sign with your actual domain, not their own. Many platforms let you set a custom DKIM selector for your domain. This is the cleanest fix because DKIM is more forwarding-resistant than SPF.
If SPF alignment fails: check whether your envelope sender (MAIL FROM) domain matches your From: header. If you are using a third-party sender that uses its own envelope domain, either set up a subdomain specifically for that sender and align it, or switch to DKIM signing for that traffic.
If you have many legitimate third-party senders: consider using a subdomain approach where each sender category uses its own subdomain (marketing.yourdomain.com, support.yourdomain.com) and set relaxed alignment for those subdomains. This keeps your main domain policy strict while allowing third-party sends.
If forwarding is causing failures: there is no permanent fix for forwarding because you do not control the forwarding chain. The practical solution is to rely more on DKIM than SPF for alignment, since DKIM is more robust against forwarding. Setting adkim=r with DKIM signing from your domain is more forwarding-tolerant.
Monitoring: Tracking Alignment Health Over Time
Alignment failures are not a one-time fix. As your email infrastructure changes, alignment can break silently. New integrations, temporary campaigns, platform migrations, or new third-party vendors can all introduce new alignment failures.
The practical way to track this is to collect and parse your DMARC aggregate reports (RUA) regularly. Aggregate reports give you a daily summary of authentication results and alignment outcomes across all your sending sources.
DMARCFlow is designed to parse these reports and surface alignment failure rates per domain and per selector, so you can see when a new integration starts generating failures without waiting for a complaint or delivery problem. This is particularly useful for multi-domain setups where manual XML processing becomes a bottleneck. If you are processing reports manually, watch for sudden increases in alignment failures as an early warning sign that something in your sending infrastructure has changed.
FAQ
Why does DMARC fail when SPF passes?
Because DMARC checks alignment in addition to authentication. SPF passing means the mail server is authorized. DMARC passing means the From: header domain also aligns with that authorization. If your From: domain does not match the authenticated sending domain, DMARC fails even when SPF passes.
What is the difference between SPF alignment and DKIM alignment?
SPF alignment checks whether the domain in the SMTP envelope (MAIL FROM) matches the From: header domain. DKIM alignment checks whether the domain in the DKIM signature matches the From: header domain. They are checked independently. A DMARC pass requires either SPF alignment or DKIM alignment to pass (not both).
How do I read a DMARC failure report?
Look inside the section of your XML report. Check the element for each auth mechanism. If alignment shows fail, the From: domain did not match the authenticated domain. If both SPF and DKIM show alignment fail, neither mechanism is aligned and DMARC will fail. The section shows what the receiving server decided to do with the message.
How do I fix DMARC alignment failures?
Fix DKIM alignment by ensuring all third-party senders sign with your actual From: domain using custom DKIM selectors. Fix SPF alignment by ensuring your envelope sender domain matches your From: domain. If you have many legitimate third-party senders, use a subdomain approach with relaxed alignment for subdomains while keeping your main domain policy strict.