DMARCGuardian Practical help for DMARC, SPF, DKIM, and BIMI.

Blog · Dmarc

Why Your DMARC Report Shows DKIM Fail and SPF Pass at the Same Time

By DMARCGuardian Editorial Team ·

When you first open a DMARC aggregate report and see DKIM fail next to SPF pass, it looks like a contradiction. It isn't. Your email is working as designed - you are just seeing something you weren't expecting.

This is one of the most common sources of confusion when people start reading DMARC reports. Once alignment is understood, it is also one of the easiest to resolve.

DMARC Runs Two Independent Checks, Not One

DMARC is built on two separate authentication mechanisms: SPF and DKIM. These mechanisms were designed independently and they remain independent in the DMARC evaluation chain.

  • SPF validates that the sending server's IP is authorized by the domain's published SPF record. It answers: "Is this server allowed to send on behalf of this domain?"
  • DKIM validates a cryptographic signature attached to the email header. It answers: "Has this email been modified since it left the sending server?"

Neither check knows about the other. When a receiver evaluates your email, it runs both checks simultaneously and records the result for each one independently. They do not depend on each other and they do not override each other.

This means you can have:

  • SPF pass + DKIM pass → DMARC pass
  • SPF pass + DKIM fail → DMARC may still pass (depends on alignment)
  • SPF fail + DKIM pass → DMARC may still pass (depends on alignment)
  • SPF fail + DKIM fail → DMARC fail

The "may still pass" cases are where most of the confusion lives, and they come down to alignment.

What Alignment Actually Means in DMARC

Alignment is the part that trips up almost everyone reading DMARC reports for the first time.

Alignment means the domain that passed SPF or DKIM must match the domain in the email's From header. If the From address says it came from example.com but the SPF check authorized mail.example.com, that is not aligned. If the DKIM signature was signed by marketing.example.com but the From shows example.com, that is not aligned either.

DMARC requires at least one aligned authenticator - SPF or DKIM. It does not require both. This is why SPF pass with DKIM fail can still result in a DMARC pass: if the SPF result is aligned with the From domain, DMARC succeeds on the strength of the SPF check alone.

The formal logic:

  • DMARC pass → aligned SPF passes OR aligned DKIM passes
  • DMARC fail → aligned SPF fails AND aligned DKIM fails

"Aligned" is the operative word. Raw authentication pass is not enough.

Why Email Still Arrives When DKIM Fails

This is the question that causes the most panic.

If DKIM is failing in your DMARC report, you expect email to stop arriving. It often doesn't. Here is why:

When a receiver evaluates an email and DMARC fails, the receiver's action depends on the domain's DMARC policy. At p=none, the receiver takes no action - email is delivered regardless. Only at p=quarantine or p=reject does the receiver do something different.

If your policy is p=none, you will see DKIM failures in your aggregate reports and your email will still arrive. The failures are real - something is misconfigured - but the email gets through because your policy told receivers not to act on failures.

Start by checking your DMARC policy tag. If it is p=none, you are in monitoring mode. Failures are being collected but not acted on by receivers.

Reading Your DMARC Report's Section

Every DMARC aggregate report contains an block for each evaluated message. The structure looks like this:


<auth_result>
  <spf>
    <domain>example.com</domain>
    <result>pass</result>
  </spf>
  <dkim>
    <domain>example.com</domain>
    <result>fail</result>
  </dkim>
</auth_result>

This tells you: SPF passed for example.com, DKIM failed for example.com. If both SPF and DKIM are aligned to the same From domain, this combination still results in a DMARC pass - because aligned SPF passes satisfies the DMARC requirement.

If you see:


<dkim>
  <domain>marketing.example.com</domain>
  <result>fail</result>
</dkim>

The signing domain marketing.example.com does not match your From domain example.com - that is an alignment failure, not just a DKIM failure. The distinction matters because an unaligned DKIM result does not contribute to DMARC pass at all, even if the raw signature check technically passed.

When DKIM-Fail-Plus-SPF-Pass Is a Real Problem

If you are at p=quarantine or p=reject and seeing DKIM failures with aligned SPF pass, you likely have nothing to fix - aligned SPF is sufficient and your DMARC is passing. But there are scenarios where the combination matters:

You are at p=reject and both checks are unaligned. If neither SPF nor DKIM is aligned with your From domain, DMARC fails and email is rejected. Some legitimate mail may stop arriving.

Forwarding breaks DKIM but not SPF. When an email is forwarded, the forwarding server modifies headers as the message passes through - which invalidates the DKIM signature. SPF still works because the forwarding server's IP gets added to the SPF check via the Received-SPF chain. So forwarded email frequently shows DKIM fail and SPF pass. If SPF is also unaligned in this scenario, DMARC fails.

Subdomain sending without explicit alignment. Many organizations use subdomains for different sending channels (marketing, transactional, internal). If your From domain is example.com but your marketing platform sends from marketing.example.com, your SPF is likely aligned but your DKIM is probably not - the signing domain does not match.

How to Fix Alignment Failures in Google Workspace and Microsoft 365

Alignment problems in Google Workspace usually come down to one thing: Google's default signing uses google.com as the signing domain, not your own domain. For DMARC to see aligned DKIM, your From address and your DKIM signing domain must match exactly. In Google Workspace, you get aligned DKIM when you send from an address in your own domain and have custom DKIM configured. The fix:

  1. In the Google Admin console, go to Apps → Google Workspace → Gmail → Authenticate email
  2. Enable DKIM and confirm the selector is pointed at your google._domainkey.example.com TXT record
  3. Make sure the "d=" field in any DKIM signature your domain generates matches your From domain exactly
  4. Check your DMARC record - if you have spf-aligned or dkim-aligned tags set strictly, any mismatch will cause alignment failure even when raw DKIM passes

Microsoft 365 alignment failures typically involve tenant domain mismatches or third-party senders using subdomains that do not align with your registered brand domain. The most common fix:

  1. In the Exchange admin center, go to Mail flow → Authentication → DKIM
  2. Add DKIM records to your DNS under your own domain (not Microsoft's default selector)
  3. Enable DKIM signing per selector in the EAC
  4. Audit your sending sources - any automated flow that uses company.onmicrosoft.com as the From address will never be aligned to your brand domain

How DMARCFlow Interprets These Reports for You

Most teams do not have a dedicated analyst to read DMARC aggregate reports. The reports are XML, they arrive from multiple receivers, and the alignment status of each source is not obvious from a raw read. This is the problem DMARCFlow was built to solve.

DMARCFlow processes your aggregate reports automatically and surfaces alignment status at the domain level. You see which sending sources are passing aligned authentication and which are failing - and unlike a raw XML read, DMARCFlow tells you whether the failure is a raw authentication problem or an alignment problem. That distinction matters: a raw DKIM pass with alignment fail is functionally different from a raw DKIM fail, and most tools do not make that call visible.

For organizations managing multiple brands, subdomains, or third-party sending platforms, tracking alignment manually in a spreadsheet is error-prone and does not scale. DMARCFlow maintains the picture continuously, so you catch alignment drift before it causes delivery failures at enforcement.

FAQ

Does email arriving mean I can ignore DKIM failures?

No. If your DMARC policy is p=none, failures are recorded but not acted on. At p=quarantine or p=reject, email delivery is at risk. Even at p=none, consistent DKIM failures on legitimate sending sources indicate a configuration problem that will eventually cause delivery issues when you tighten your policy.

Should I fix DKIM before SPF?

Both matter but for different reasons. SPF is faster to fix and propagates more quickly. DKIM is more durable once set up - DKIM keys do not expire or need regular renewal. For most organizations, setting up aligned DKIM correctly is the more permanent fix.

My DMARC passes but I still see spoofing of my domain. Why?

If DMARC passes for your own sending but external domains are still being spoofed, the spoofing is happening from domains you do not control. DMARC protects your domain from being impersonated in the From field of emails. It does not prevent someone from sending email that claims to be from a different domain. Check whether the spoofed From domain matches your registered domain exactly - if it is a lookalike or misspelling, DMARC is not designed to catch that.

How long do DKIM changes take to propagate?

DKIM DNS changes typically take effect within minutes to a few hours, but receivers may cache DKIM records for up to 48 hours before re-checking. During that window, the old key may still be considered valid. Plan for a 24-48 hour stabilization period after rotating DKIM keys.