Blog · Dmarc
Why DMARC Fails Even When SPF and DKIM Both Pass
If your emails are failing DMARC checks but SPF and DKIM both show "pass" in the headers, the issue is almost never that your SPF or DKIM records are wrong. The issue is alignment.
Alignment is the part most tutorials skip. They explain how to set up SPF and DKIM, get everything showing pass, and then watch DMARC still fail. Here is why that happens and how to fix it.
Authentication vs. Alignment: The Short Version
SPF and DKIM answer one question: was this email sent by someone allowed to send on behalf of this domain?
DMARC asks a different question: does the domain that sent the email match the domain that says it sent the email?
That second question is alignment. You can have perfect SPF and DKIM records and still fail DMARC if the domains do not match up correctly.
What DMARC Actually Checks
When a mail server receives an email, it runs three separate checks:
- SPF checks the envelope-from domain (also called Return-Path) against the sender IP address.
- DKIM checks the cryptographic signature against a domain published in the DKIM record.
- DMARC checks whether the domain shown in the From header matches the domain authenticated by SPF or DKIM.
For DMARC to pass, at least one of SPF or DKIM must authenticate successfully, AND the aligned domain must match the From header domain.
This is the part that catches people. SPF and DKIM can both pass, but if neither of them is aligned with the From domain, DMARC fails.
The Three Alignment Scenarios
SPF aligned, DKIM not aligned
The Return-Path domain matches the From domain. SPF passes alignment. But the DKIM signature is signed by a different domain (common with third-party email providers). Since neither aligned check passes, DMARC fails.
Example: You send marketing email through Mailchimp. Your From header shows @yourdomain.com. Mailchimp's DKIM signs with its own domain. SPF passes because Mailchimp is authorized. DKIM passes but is not aligned. DMARC fails.
DKIM aligned, SPF not aligned
The DKIM signature uses your From domain. DKIM passes and is aligned. But the Return-Path domain does not match your From domain. SPF fails alignment. Since at least one aligned check is required, DKIM-aligned alone is enough for DMARC to pass.
Both pass but neither is aligned
Both SPF and DKIM return pass, but neither authenticated domain matches the From header. This is the most confusing scenario. The mail is legitimate, your records are correct, and DMARC still fails because alignment is missing.
Common Causes of Alignment Failure
Third-party email service providers
When you send through an ESP (SendGrid, Brevo, Mailchimp, etc.), the DKIM signature is typically signed with the ESP's domain, not yours. This breaks DKIM alignment. You can fix this by configuring your ESP to sign with your own domain (custom DKIM), or by adding the ESP's sending domain to your SPF record and ensuring your DMARC policy handles third-party senders correctly.
Subdomain mail
If you send from sub.example.com but your DMARC record only covers example.com, alignment fails because the From header domain (sub.example.com) does not exactly match the parent domain. You either need a DMARC record on the subdomain or a "sp" tag on the parent domain that explicitly covers subdomains.
Forwarded mail
When someone forwards your email, the forwarding MTA changes the Return-Path to its own domain. SPF then authenticates the forwarding server, not your original sending domain. DKIM may still pass if the forwarding MTA does not modify the DKIM signature. DMARC alignment fails because the authenticated domains no longer match the From header. ARC (Authenticated Received Chain) was designed to handle this, but many forwarders do not implement it correctly.
How to Read Your DMARC Reports to Find Alignment Failures
Your DMARC aggregate reports (RUA) tell you exactly why emails are failing alignment. Look for these patterns in the <auth_results> section of your XML reports:
- SPF "pass" with a d= value that does not match your From domain
- DKIM "pass" with a d= domain that is your ESP's domain, not yours
- Both pass but DMARC result is "fail"
DMARCFlow parses these reports and surfaces alignment failures with the specific DKIM and SPF results shown side-by-side, making it easier to see which third-party senders are breaking alignment and whether the failures are concentrated in one ESP or scattered across multiple sources.
How to Fix Alignment Failures
Step 1: Identify the source
Use your DMARC aggregate reports to find which IPs and sending sources are failing alignment. Look for patterns in the aligned domain vs. From domain mismatch.
Step 2: Configure custom DKIM with your ESP
Most major ESPs let you add a custom DKIM record on your own domain. This signs the email with your domain instead of the ESP's, fixing DKIM alignment. This is the cleanest solution for bulk senders.
Step 3: Add third-party senders to your SPF record
If you use third-party services that send mail on your behalf, include their sending IPs in your SPF record. This fixes SPF alignment.
Step 4: Set a subdomain policy
If you send from subdomains, add a "sp" tag to your DMARC record:
v=DMARC1; p=quarantine; sp=reject; rua=mailto:reports@yourdomain.com
This tells receivers how to handle mail from your subdomains specifically.
Step 5: Monitor before you harden
Before moving from p=none to p=quarantine, watch your reports for at least two weeks. Look for any legitimate sources that are not yet aligned. Forgetting a vendor before hardening is how legitimate mail breaks.
DMARCFlow sends daily aggregate reports by email and flags alignment failures specifically, so you do not have to parse raw XML to catch an unaligned third-party sender before it causes problems.
Quick Reference: SPF, DKIM, and DMARC Together
| Check | What it verifies | Aligned domain |
|---|---|---|
| SPF | Sender IP is authorized for the Return-Path domain | Return-Path domain matches From domain |
| DKIM | Email was signed by the domain in the DKIM signature | DKIM d= domain matches From domain |
| DMARC | At least one aligned SPF or DKIM check passes | From domain matches authenticated domain |
DMARC requires one of SPF or DKIM to pass AND alignment with the From domain. Authentication without alignment is not enough.
FAQ
Can DMARC pass if only SPF passes and DKIM fails?
Yes. DMARC needs only one aligned authentication check. If SPF passes and is aligned with the From domain, DMARC passes regardless of DKIM.
Can DMARC pass if only DKIM passes and SPF fails?
Yes. If DKIM passes and is aligned with the From domain, DMARC passes regardless of SPF.
Why does forwarded mail fail DMARC even with perfect SPF and DKIM?
Forwarding changes the Return-Path domain to the forwarder's domain. SPF then authenticates the forwarder. DKIM may survive if the forwarder does not modify headers. But alignment fails because the From header no longer matches the authenticated domains.
Does ARC fix forwarded mail DMARC failures?
ARC (Authenticated Received Chain) was designed for this. It adds a header chain showing the original authentication results. Some forwarders and security platforms implement it, but it is not universal. Do not rely on ARC to fix DMARC alignment for forwarded mail.
Does DMARCFlow show alignment failures?
Yes. DMARCFlow parses aggregate reports and flags IPs where SPF or DKIM pass but alignment fails. This is the fastest way to find the third-party senders and forwarding rules causing DMARC failures.