Why DMARC Fails for One Domain When Others Pass

One of your domains fails DMARC checks. Every other domain on the same mail setup passes cleanly. You have not changed your SPF or DKIM records recently. Why is this happening?

The short answer is that DMARC checks alignment, not just authentication. A domain can have valid SPF and DKIM records and still fail DMARC because the domain in the message header does not align with the domain that was authenticated during SMTP delivery. This mismatch affects one domain and not others because that domain has a specific sending configuration the others do not share.

DMARCFlow's aggregate report monitoring is built for exactly this diagnostic moment. Instead of manually parsing XML reports, you get per-domain failure rates surfaced immediately, with source IPs and auth results already parsed. The alignment problem that would otherwise take hours to find by hand shows up in minutes. The sections below explain what is causing the failure and how alignment diagnosis works whether you use a monitoring tool or do it by hand.

DMARC Alignment Is Different From SPF or DKIM Pass

Before getting into specific causes, it helps to be clear on what DMARC actually checks. SPF and DKIM each answer a single question: was this mail server authorized to send for this domain (SPF), and did this message pass DKIM signature validation (DKIM)? DMARC adds a second question on top of that: does the domain that was authenticated match the domain in the message From header?

This second question is alignment. A message can pass SPF and DKIM individually and still fail DMARC because the aligned domain does not match the From domain. When one domain fails DMARC while others pass, the alignment step is where the problem lives.

Five Reasons One Domain Fails DMARC While Others Pass

1. Subdomain vs. Root Domain Alignment Mismatch

This is the most common cause. The From header shows a subdomain such as marketing.example.com but the SMTP envelope Return-Path is example.com. SPF validates against example.com and passes. DKIM might also sign example.com. But DMARC alignment checks whether the From domain matches the authenticated domain, and a subdomain does not align with its parent by default.

You see this pattern when different teams or tools send from different subdomains of the same root domain. The root domain passes DMARC because its From and Return-Path match. The subdomain fails because its From domain does not align with the root domain used in the envelope.

To confirm this, check your DMARC aggregate report. Look for the failing domain in the report and check the auth_results section. If you see SPF pass and DKIM pass for example.com while the From header shows a subdomain, that is your answer.

2. DKIM Selector Signs a Different Domain Than the From Header

DKIM signatures carry a domain in the d= field of the signature header. This domain must match the From header domain for DMARC alignment to pass. If your DKIM selector is configured to sign with a different domain than your From header, alignment fails even when the signature itself is valid.

This commonly happens with third-party email tools, marketing automation platforms, and legacy mailing systems that apply their own DKIM signature using their default selector rather than your sending domain. One domain in your setup might be routed through such a tool while your other domains send directly. The others pass DMARC. The tool-affected domain fails.

To diagnose, look at the DKIM signature on a failing message. Check the d= value in the DKIM-Signature header. Compare it to the From header domain. If they differ, that is the misalignment causing your failure.

3. From Header Domain Does Not Match Return-Path Domain

The Return-Path domain is set during SMTP delivery and becomes the envelope sender. The From header is what the recipient's mail client displays. These two domains do not have to match by RFC, but DMARC alignment requires them to match for DMARC to pass.

Forwarded messages are the most common cause of this. When a message is forwarded, the original From header is preserved but the Return-Path is rewritten to the forwarder's domain. The forwarded message then fails DMARC at the final destination because the From domain and the envelope domain no longer align.

This is less common as a cause of one domain failing while others pass, unless that specific domain is the one being forwarded. But if your aggregate report shows alignment failures without SPF or DKIM failures for just one domain, a forwarding rule on that domain is worth checking.

4. Different Sending Infrastructure for One Domain

One domain might be sent through a different mail server, ESP, or SMTP relay than your other domains. That infrastructure might not be configured to sign DKIM for your domain, might use a different envelope domain, or might not support SPF alignment correctly.

This is common when one domain was added later and configured manually, when a specific product line uses its own sending system, or when a third-party service was set up without proper alignment configuration.

Your DMARC aggregate report shows this clearly. Each source IP sending for your domain appears in the report. If a domain is failing but the source IPs in the report look correct for your infrastructure, check whether that domain actually uses the sending infrastructure you think it does.

5. Third-Party Senders Without Aligned DKIM

If you use third-party senders for specific domains such as customer support platforms, transactional email services, or marketing tools, those senders need to either DKIM-sign with your From domain or be explicitly authorized in your DMARC record through external validation. If they send using their own domain in the DKIM signature and do not set up alignment with your From domain, those messages fail DMARC.

This is a narrower version of cause 2 and cause 4. It matters for single-domain failures specifically because only one of your domains might use that third-party sender. Your other domains send through your primary infrastructure and pass DMARC. The domain using the third-party sender fails.

The fix is to either configure DKIM signing with your From domain at the third-party sender or update your DMARC record to use relaxed alignment (adkim=r) and ensure the third-party DKIM domain has a parent relationship with your From domain.

How to Diagnose Which Cause Is Affecting Your Domain

Work through these checks in order.

First, pull your DMARC aggregate report for the failing domain. The report shows auth_results for each message source IP. Check whether SPF and DKIM are passing individually. If both pass but DMARC fails, you have an alignment problem, not an authentication problem. That narrows the search immediately.

Second, look at the message headers on a failing message from that domain. Find the DKIM-Signature header and check the d= value. Find the From header and check the domain. Compare them. If they differ, you have a DKIM alignment problem (cause 2 or cause 5).

Third, check your SPF record and your envelope sender domain. If your SPF record covers example.com but your From header shows a subdomain, you have a subdomain alignment problem (cause 1).

Fourth, check whether any third-party senders or forwarding rules are active for that specific domain. If only one domain is affected and the others are not, something is different about how that domain sends mail compared to the others.

Quick Checklist: Fix One Failing Domain Without Breaking Others

Check the DKIM d= domain against the From header domain on a failing message
Confirm the Return-Path domain matches the From header domain
Identify whether a subdomain in the From header needs its own aligned SPF and DKIM or needs relaxed alignment in your DMARC record
Verify that any third-party senders for this domain are DKIM-signing with the correct domain
If you updated your DMARC record to fix this domain, test it with a small message volume before relying on it for full traffic

FAQ

Can a domain pass SPF and DKIM but still fail DMARC?

Yes. SPF and DKIM validate separately. DMARC then checks whether the domains they authenticated align with the From header domain. A domain can pass both SPF and DKIM and still fail DMARC if the authenticated domain does not match the From header domain.

Does relaxed alignment (adkim=r) fix subdomain problems?

Relaxed alignment treats subdomains as aligned with their parent domain. If your From header is subdomain.example.com and your SPF or DKIM authenticates example.com, relaxed alignment allows that to pass DMARC. Strict alignment (adkim=s) would fail it. If you are having subdomain alignment problems, relaxed alignment is worth considering, but only after understanding why the misalignment exists in the first place.

Can forwarding cause a permanent DMARC failure for one domain?

Forwarding rewrites the Return-Path to the forwarder's domain, which breaks alignment. If messages from your domain are being forwarded through a service that rewrites the envelope, those forwarded messages will fail DMARC. This is a fundamental limitation of DMARC with forwarding and is not easily fixed without either disabling forwarding or using Message Transfer Agency Strict Transport Security (MTA-STS) with authenticated received chain (ARC) to preserve the original sender information.

How do I check which domain is actually in my DKIM signature?

Look at the DKIM-Signature header field in a raw message. Find the d= tag. That is the domain that DKIM is claiming responsibility for. Compare it to the domain in the From header. If they differ, alignment will fail DMARC.

Why does only one of my domains fail while using the same sending infrastructure?

The sending infrastructure is usually the same, but the From header domain is different. Check whether one domain uses a subdomain, whether it routes through a different ESP or tool, or whether a third-party service is attached to it specifically. The sending server might be the same, but what it puts in the From header and how it signs DKIM can differ per domain.