Why DMARC Fails Even When SPF Passes

Your SPF check says pass. Your DMARC check says fail. You stare at the headers and wonder what you missed.

The short answer: SPF and DMARC are two separate checks. SPF validates that the sending server is allowed to send for a domain. DMARC validates that the From address domain matches the domain that passed SPF or DKIM. You can have one without the other.

What DMARC alignment actually means

DMARC has one requirement that catches most people: the domain in the From header must align with the domain that passed SPF or DKIM.

Alignment has two modes.

**SPF alignment** means the domain in the From header matches the domain in the MAIL FROM (envelope) address that passed SPF. If your From header says example.com but the envelope says mail.example.com and SPF only authorized mail.example.com, alignment fails.

**DKIM alignment** means the domain in the From header matches the domain in the DKIM-Signature header that verified the message. If your From says example.com but the DKIM signature is signed by marketing.example.com, alignment fails.

For DMARC to pass at p=reject or p=quarantine, at least one of these alignments must succeed. Not both. But at least one.

This is where the confusion starts. People see SPF pass and assume everything is fine. They do not realize that SPF passing is only half the check.

Why SPF pass does not equal DMARC pass

Here are the most common scenarios where SPF passes but DMARC still fails.

**Forwarded mail.** Someone receives your email and forwards it to a mailing list or another person. The forwarded server is not in your SPF record. The SPF check on the forwarded message fails. Even if your original SPF passed at the first hop, the forwarded message now fails both SPF and DMARC because the alignment check is evaluated at each hop.

**Third-party email relay with a different From domain.** Your company uses a marketing email platform that sends from your domain via a dedicated IP, but the platform uses its own MAIL FROM domain or DKIM selector. If the From header is your domain but the DKIM selector belongs to the marketing platform, DMARC alignment fails.

**Subdomain mismatch.** Your From header says newsletter.example.com but your SPF record covers only example.com and your DKIM selector is configured for example.com rather than the subdomain. Both SPF and DKIM may technically pass at the record level but alignment fails.

**Mailing list participation.** You subscribe to a mailing list that uses your domain in the From header. The mailing list server re-sends your message. SPF passes for the mailing list server. But the From domain on the message is still yours. If the mailing list does not re-sign with your DKIM key, DMARC fails.

How to diagnose the specific failure mode

The DMARC aggregate report is where you find the answer. It is the XML file your domain receives from other mail servers that receive your mail. You want three fields in particular.

The `source_ip` tells you which server processed the message. Cross-reference this against your known sending infrastructure.

The `dkim` result tells you whether DKIM verified. Look for "pass" or "fail" and also check whether the `domain` value matches your From header domain. A DKIM pass on a different domain does not help DMARC alignment.

The `spf` result tells you whether SPF validated. Again, check whether the aligned domain matches your From header domain.

If you see SPF pass and DKIM fail, check DKIM alignment. If you see both pass, check whether the aligned domain matches your From domain specifically.

If you are using a third-party sender, their server IP should appear in your aggregate reports. If you do not see them listed and mail is going out with your From domain, that is a red flag: either they are sending through their own infrastructure without your knowledge, or they are signing with their own domain instead of yours.

How DMARCFlow helps you find alignment failures faster

Reading raw XML aggregate reports is slow and easy to get wrong. DMARCFlow parses the auth result breakdown per sending source and shows you which IPs are passing DKIM, which are passing SPF, and whether alignment actually succeeded. The difference between "SPF pass" and "SPF pass with alignment" matters for your DMARC result, and that distinction is visible in the parsed report in a way that raw XML does not make obvious.

For teams running their own email infrastructure, DMARCFlow also flags new sending sources that appear with your From domain but were not there yesterday. A new source IP with alignment failures is usually a sender configuration change you did not approve. Catching that early is more valuable than troubleshooting it after a policy move to p=reject breaks your email.

Quick-reference summary

• SPF pass does not automatically mean DMARC pass
• DMARC requires alignment between the From header domain and the domain that passed SPF or DKIM
• Both SPF and DKIM have their own alignment checks
• At least one alignment must pass for DMARC to pass
• Forwarding, third-party senders, subdomains, and mailing lists are common causes
• Aggregate reports tell you which IPs are failing and why
• Dedicated parsing tools make the diagnosis faster and more reliable than reading raw XML

If you are already publishing a DMARC record and watching aggregate reports come in, the next step is to verify that every sending source in the report is expected and aligned. Any unexpected source or repeated alignment failures are worth investigating before moving to p=reject.

Frequently asked questions

**Does SPF pass mean DMARC will pass?**

No. SPF validates that the sending server is authorized. DMARC validates that the From header domain aligns with the domain that passed SPF or DKIM. Both checks are independent. You can have a valid SPF result and still fail DMARC if alignment does not match.

**What is the difference between SPF and DMARC alignment?**

SPF alignment means the From header domain matches the MAIL FROM domain that passed SPF. DKIM alignment means the From header domain matches the domain in the DKIM-Signature header that verified the message. DMARC requires at least one of these to align, not both.

**Can mail pass SPF but fail DMARC because of forwarding?**

Yes. When a message is forwarded, the next receiving server performs its own SPF and DMARC checks. The forwarded server is not in the original sender's SPF record, so SPF fails at the forwarding hop. DMARC also fails because the forwarding server is not an authorized sender for the original domain.

**How do I read a DMARC aggregate report to find alignment failures?**

Look for the `dkim` and `spf` result fields in each record. Check whether the `domain` value in each result matches your From header domain. A DKIM result that shows "pass" but a domain that does not match your From domain is an alignment failure, not a DMARC pass.

**Is it possible to have DMARC pass with DKIM but without SPF?**

Yes. DMARC requires at least one alignment to pass. If DKIM alignment succeeds, DMARC passes regardless of SPF. Similarly, if SPF alignment succeeds, DMARC passes even if DKIM fails. Both are not required, but at least one must align.