Why DMARC Fails Even When SPF and DKIM Both Pass

You have published your SPF record. You have set up DKIM. Your email headers show both checks pass. Then you open your DMARC aggregate report and see something like 40% of your mail failing.

This is one of the most common outcomes in email authentication, and it confuses almost everyone who encounters it for the first time.

The reason is straightforward once you understand what DMARC actually checks: it does not just run SPF and DKIM, it verifies that the domains those checks use are aligned with the domain in your From header.

Authentication vs Alignment: Two Separate Things

SPF and DKIM are authentication mechanisms. They answer the question: "Was this email sent from infrastructure that is authorized to send on behalf of this domain?"

DMARC is a policy layer that adds a second question on top: "Does the domain that passed SPF or DKIM match the domain in the visible From header?"

This second question is called alignment. It is the part most people skip when they first set up email authentication.

How SPF alignment works

When an email is sent, the mail transfer agent records a domain in the SMTP envelope, known as the MAIL FROM domain (sometimes called the envelope-from or return-path domain). This is the domain SPF actually checks.

The alignment check asks: is that MAIL FROM domain the same as, or a subdomain of, the domain shown in the RFC5322.From header of the email?

If you send from news@example.com and your MAIL FROM is mail.example.com, those two are not the same domain. Alignment fails unless example.com is a parent of mail.example.com and you are using relaxed alignment mode.

How DKIM alignment works

DKIM signs a portion of the email headers and body using a private key held on your mail server. The signature includes a d= tag that declares the signing domain.

The alignment check asks: does that signing domain match the RFC5322.From header domain?

If you send from contact@example.com but the DKIM signature is from d=mail.sendingplatform.com, those domains do not align. DMARC rejects or quarantines the message.

Relaxed vs Strict Alignment

DMARC gives you two alignment modes. The difference matters for most real-world deployments.

Relaxed alignment (the default) accepts any subdomain of the From domain as aligned. example.com and sub.example.com are treated as aligned under relaxed mode.

Strict alignment requires an exact match. example.com and sub.example.com are not aligned under strict mode. Nothing else passes.

Most organizations run in relaxed mode because legitimate third-party senders often use their own infrastructure. Strict mode is rare outside of organizations that control every sending system themselves.

Four Common Causes of Alignment Failure

1. Using a third-party email sender without proper DKIM signing

This is the single most common cause of DMARC failures when SPF and DKIM both appear to pass.

When you send through an ESP, marketing platform, or transactional email service, the MAIL FROM domain is usually set to something on the provider's infrastructure, not your domain. Your SPF record may include the ESP's sending IPs, so SPF check passes, but the MAIL FROM domain belongs to the ESP, not to you.

The fix is DKIM signing on behalf of your domain. Most reputable providers offer custom DKIM keys tied to your domain. Without that, DKIM signs the ESP's domain, not yours, and DKIM alignment fails.

2. Subdomain vs root domain mismatch

If your From header uses subdomain.example.com but your SPF record and DKIM keys are published on example.com, neither alignment check passes under strict mode. Under relaxed mode, it depends on your DMARC policy settings.

This catches people who set up authentication for the root domain but send from a subdomain.

3. Shared mail infrastructure and cloud tenants

Microsoft 365, Google Workspace, and other cloud platforms use their own sending infrastructure for some message flows. The MAIL FROM domain during certain operations may not match your branded From domain.

Microsoft 365 uses fit.jp.microsoft.com as a MAIL FROM domain for some relay scenarios, for example. If your From header is sender@yourcompany.com, the MAIL FROM domain and your From domain are completely different.

4. Forwarded mail and the ARC dependency

When an email is forwarded, the forwarder's mail server becomes the new sending MTA. This typically breaks SPF alignment because the forwarder's MAIL FROM domain replaces the original. DKIM may survive depending on whether the forwarding server resends the original headers unchanged.

This is a known limitation. DMARC cannot authenticate forwarded mail reliably unless the forwarder participates in ARC (Authenticated Received Chain), which records the original sending authentication results before forwarding occurs.

How to Diagnose Alignment Failures in DMARC Reports

Your DMARC aggregate reports ( rua ) are the primary diagnostic tool. They tell you which sending sources are failing and why, broken down by domain.

Look for sources where the alignment result is fail but the authentication result (SPF or DKIM) is pass. That is the signature pattern of an alignment failure.

The report XML can be dense. DMARCFlow parses aggregate reports and surfaces the alignment vs authentication result side by side, so you can immediately see which sending source is using a mismatched MAIL FROM or DKIM domain.

If you are reviewing raw XML, focus on these fields:

: the IP sending the mail
result: pass or fail
result: pass or fail
results for both SPF and DKIM: pass or fail

When you see SPF pass + SPF alignment fail, the MAIL FROM domain does not align with your From header.

When you see DKIM pass + DKIM alignment fail, the DKIM signing domain does not align with your From header.

How to Fix Alignment Failures

The fix depends on which alignment type is failing.

For SPF alignment failures with third-party senders: configure the ESP to use your domain as the MAIL FROM domain (custom subdomain), or add their sending IPs to your SPF record with the appropriate domain. If they support SRS (Sender Rewriting Scheme), that also normalizes the MAIL FROM to preserve your domain.

For DKIM alignment failures: ensure the ESP signs with a DKIM key published on your domain, not their default signing domain. This usually means adding a custom DKIM selector to your DNS.

For strict mode failures: relax your alignment setting to aspf=relaxed if your policy currently specifies aspf=strict. This is a common and safe change when you have legitimate third-party senders.

For forwarding failures: there is no permanent fix at your end. Enable ARC on your inbound mail servers to preserve authentication results through forwarding chains, and accept that forwarded mail from strict DMARC domains will sometimes fail.

Quick Reference: SPF Pass + DKIM Pass + DMARC Fail Checklist

Use this when your reports show the confusing pass/pass/fail pattern.

Is your From header domain the same domain where SPF and DKIM are configured?
Are you sending through an ESP or third-party platform? If yes, is custom DKIM signing configured for your domain?
Is your DMARC alignment mode set to relaxed (aspf=relaxed) if you have multiple sending sources?
Do any of your sending sources use a MAIL FROM domain that differs from your From header domain?
Have you recently changed email platform or added a new sending integration?
Are the failures coming from forwarded mail (ARC-breaking forwarding chains)?

Why This Matters

Alignment exists because authentication alone is not sufficient to prevent spoofing. An attacker can send mail through a server that legitimately passes SPF for their own domain, or sign email with DKIM keys for a domain they control. Alignment closes that gap by requiring the authenticated domain to match the domain your recipients see.

Understanding alignment failures is not an academic exercise. When your own legitimate mail fails DMARC because of an ESP configuration or a subdomain mismatch, you need to be able to read your reports and identify the root cause quickly. DMARC aggregate reports give you that visibility, but only if you know what alignment means and how to look for it.

FAQ

Why does DMARC fail when SPF passes?

SPF passing means the mail server sending the email is authorized to send for the MAIL FROM domain. DMARC also checks whether that MAIL FROM domain aligns with your From header domain. If it does not, DMARC fails even though SPF passed.

Why does DMARC fail when DKIM passes?

DKIM passing means the email was signed with a valid key for the domain in the DKIM signature's d= tag. DMARC checks whether that signing domain matches your From header domain. If the signing domain does not match, DMARC fails.

What is the difference between SPF authentication and DMARC alignment?

SPF authentication verifies that the sending mail server is authorized for the MAIL FROM domain. DMARC alignment checks whether that MAIL FROM domain or the DKIM signing domain matches the visible From header. Authentication can pass while alignment fails.

How do I read DMARC reports to find alignment failures?

Look for sources where or shows pass but the corresponding element shows fail. DMARCFlow parses these reports and displays them side by side. In raw XML, focus on the auth results and alignment elements for each source IP.

What is relaxed vs strict DMARC alignment?

Relaxed alignment accepts any subdomain of your From domain as aligned. Strict alignment requires an exact match. Relaxed is the default and suits most organizations with third-party senders.