DMARC Alignment Survives Setup but Dies When Your Tool Changes

Meta-Title: Why DMARC Alignment Fails When SPF and DKIM Both Pass Meta-Description: SPF and DKIM both pass but DMARC fails. The difference is alignment. This guide explains why it happens and how to fix it. Status: ready

Body

If you have SPF and DKIM set up and both are passing, you might expect DMARC to pass as well. Often it does not. The reason is that DMARC requires more than just authentication records to pass. It requires alignment.

What DMARC Alignment Actually Means

DMARC alignment is the part practitioners often miss. You can have a valid SPF record and a valid DKIM signature, but if the domain used in the SPF check or the DKIM signature does not match the domain in the From header of the email, DMARC will fail.

DMARC has two alignment modes: relaxed and strict. In relaxed mode, the organizational domains just need to match. In strict mode, the domains need to match exactly. Most organizations use relaxed alignment, which sounds easier to achieve but still trips up many.

How Tool Migration Breaks DMARC Alignment

One of the most common ways DMARC alignment breaks is during email platform migrations. Here is what happens.

Your original email platform sends mail from @yourdomain.com. The DKIM selector is configured in your DNS, and the DKIM signature uses yourdomain.com as the domain. When your platform sends email, it signs the message with your DKIM key, and the signature includes yourdomain.com. DMARC checks out, alignment is satisfied, and messages pass.

Then you migrate to a new email platform. The new platform has its own DKIM keys and its own selector. Your DNS records for the old DKIM selector may or may not still be published. Even if they are, the new platform is not using them. Instead, the new platform signs with its own selector, which might use a subdomain like dkimsender.com or a third-party ESP domain as the signing domain rather than yourdomain.com.

When the new platform sends email, the DKIM signature uses the new selector domain, not yourdomain.com. The From header still says @yourdomain.com. DMARC checks the DKIM result and finds pass. Then it checks alignment. The signing domain does not match the From domain. Alignment fails. DMARC fails.

The SPF Equivalent

The same problem happens with SPF, though differently. If your old platform had its mail servers in your SPF record, the new platform probably does not. The new platform sends from its own IP addresses, which are not in your SPF record. SPF fails.

Even if you update your SPF record to include the new platform, if the new platform sends from multiple IPs or uses a third-party relay, the Mail-From domain in the SMTP conversation may not match yourdomain.com. That mismatch causes alignment to fail even if the SPF check itself passes.

Why Setup Can Pass But Migration Breaks

You might be thinking: DMARC passed during the initial setup. Everything worked. The testing phase was green across the board. Now the migration happens and suddenly DMARC fails for legitimate email.

The answer is usually a combination of DKIM key changes and SPF record gaps. During setup, you likely tested with your existing platform. The existing platform had the right DKIM keys and the right SPF include statements. The moment you switch platforms, those records no longer match the sending infrastructure.

Your monitoring tool may also have been sending test messages that came from the old platform, so you never saw the new platform fail in the test phase. The migration itself was the trigger that broke alignment.

How to Fix It

Fixing DMARC alignment after a migration requires updating both your authentication records and your sending configuration.

Step 1: Set Up DKIM with the New Platform

The first thing to do is add DKIM records for the new platform. Most major email platforms give you DKIM records to publish in your DNS. These records use your domain as the selector domain, not the platform domain. This is critical. The DKIM signature must sign with your domain, not the platform domain.

For example, if you are migrating to Brevo, they will give you DKIM records like selector._domainkey.yourdomain.com. You publish those records. When Brevo sends email on your behalf, it signs with yourdomain.com. The DKIM result passes and the alignment check passes because the signing domain matches your From domain.

Step 2: Update Your SPF Record

Add the new platform to your SPF record. If the new platform gives you an include statement, add it. If they give you IP addresses, add those. If they relay through a specific provider, make sure that provider is covered.

One common mistake is to have two include statements in the SPF record for two different platforms. That is fine as long as both platforms are sending legitimate mail for your domain. If one platform is no longer in use, remove it.

Step 3: Verify Alignment

Before declaring victory, verify that alignment actually passes. The best way to do this is to send a test message to a DMARC monitoring address and check the report. The report will show:

Whether DKIM signed with your domain or a third-party domain. Whether the SPF Mail-From domain matched your From domain. Whether alignment passed or failed.

If DKIM signed with a third-party domain, the signature is technically valid but alignment will fail. Fix the DKIM selector configuration.

The Key Point

DMARC alignment is the bridge between authentication and authorization. Authentication says a server is allowed to send for a domain. Alignment says the domain in the message matches the domain that authenticated. Both need to be true for DMARC to pass.

When you migrate platforms, both your DKIM keys and your SPF record can break. The new platform does not have the old DKIM keys and the old platform is no longer in your SPF record. The migration triggers a mismatch between who is sending and who is authorized.

Set up DKIM with the new platform using your domain as the signing domain. Update your SPF record to include the new platform. Verify alignment with a test message before going live.

How DMARCFlow Helps

DMARCFlow monitors your DMARC reports and flags alignment failures. When a migration breaks alignment, DMARCFlow shows you exactly which messages failed, which authentication mechanism failed, and whether the failure was due to DKIM alignment, SPF alignment, or both.

Without a monitoring tool, you only find out about alignment failures when legitimate email stops arriving. DMARCFlow gives you advance warning so you can fix the configuration before the migration causes delivery problems.