Blog · Dmarc
Why DMARC Fails When SPF and DKIM Both Pass (Microsoft 365 + Cloudflare DNS)
You check your email headers. SPF: pass. DKIM: pass. DMARC: fail.
You have never felt more confused.
If you run your domain through Cloudflare DNS and send email through Microsoft 365, this situation is not a bug in your records. It is a feature of how DMARC works that most people never learn until they run into it.
Here is what is happening, and how to fix it.
Authentication and alignment are not the same thing
SPF and DKIM are authentication mechanisms. They answer the question: was this email actually sent by the server it claims to be from?
DMARC does something separate. It checks alignment: does the visible sender domain in the email match the domain that was authenticated by SPF or DKIM?
That distinction is the whole problem.
DMARC has two checks: 1. Authentication: SPF and DKIM verify the sending server. 2. Alignment: the domain in the From header (RFC5322.From) must match the domain verified by SPF or DKIM.
Both must pass. You can have SPF pass, DKIM pass, and still get a DMARC failure if the domains do not align.
The three domains in every email
In any email you send, there are at least three domain names at work:
- RFC5322.From: the address your recipients see. This is what DMARC checks.
- RFC5321.MailFrom (Return-Path): the server that originated the message. SPF authenticates this domain.
- DKIM domain (the d= field in the DKIM-Signature): the domain that signed the message.
DMARC alignment means the RFC5322.From domain must match at least one of: the SPF domain or the DKIM domain.
When it does not, authentication passes but DMARC fails.
Why Microsoft 365 + Cloudflare creates this problem
Microsoft 365 has a default behavior that trips people up. It sends from yourdomain-com.mail.protection.outlook.com when you have not fully configured custom domain sending, even if your From address shows your custom domain.
Here is the sequence:
- Your From header says: sender@yourdomain.com
- Your SPF record in Cloudflare DNS authorizes: yourdomain.com
- Your DKIM is configured in Microsoft 365, but the DKIM signature domain is: yourdomain-com.mail.protection.outlook.com
DMARC sees: From header shows yourdomain.com, DKIM domain shows protection.outlook.com. These do not match. Alignment fails. DMARC fails.
This can also happen if you use Cloudflare Email Routing to forward messages. Cloudflare rewrites the Return-Path, which breaks SPF alignment even when your DKIM is valid.
How to diagnose your alignment failure
You need to look at the raw email headers. Most email clients let you view full headers. Here is what to check:
1. Find the From header
From: Sender Name <sender@yourdomain.com>
This is what DMARC is checking.
2. Find the Return-Path (RFC5321.MailFrom)
Return-Path: <sender@yourdomain.com>
SPF authenticates this domain. If this domain does not match your From domain, alignment fails.
3. Find the DKIM-Signature
DKIM-Signature: v=1; a=rsa-sha256; d=yourdomain.com; ...
The d= domain must match your From domain for DKIM alignment to pass.
4. Check the alignment yourself
- Does your From domain (yourdomain.com) match your Return-Path domain (yourdomain.com)?
- Does your From domain match your DKIM d= domain (yourdomain.com)?
If either match is true, alignment passes. If neither matches, DMARC fails.
The fastest way to see which sources are failing alignment: download your DMARC aggregate report (the XML file sent to your rua address) and look for the source_ip tags where dkim_alignments or spf_alignments show "fail". Each failed source IP tells you exactly which sending system is causing the problem. DMARCFlow parses these reports automatically and shows you a plain list of failing source IPs, so you do not have to read XML.
How to fix DMARC alignment in Microsoft 365
Fix 1: Enable DKIM signing for your custom domain
In the Microsoft 365 admin center, go to Settings > Domains. Select your domain. Under DKIM, enable it for your custom domain.
Microsoft will ask you to publish two CNAME records in your DNS. In Cloudflare DNS, add these:
selector1._domainkey.yourdomain.com -> selector1-yourdomain-com._domainkey.protection.outlook.com
selector2._domainkey.yourdomain.com -> selector2-yourdomain-com._domainkey.protection.outlook.com
If these records are missing, your DKIM signature will validate against the outlook.com domain instead of your domain, and DMARC alignment will fail.
Fix 2: Verify your sending domain in Microsoft 365
Make sure your custom domain is set as the primary sending domain in the Microsoft 365 admin center and that it passes domain verification. If Microsoft 365 is still defaulting to onmicrosoft.com for sending, your From header and your DKIM domain will not match.
Fix 3: Check for subdomain misalignment
If your DMARC policy is on yourdomain.com but you are sending from subdomain.yourdomain.com, alignment fails by default with strict mode.
Switch to relaxed alignment mode if you are sending from subdomains:
v=DMARC1; p=reject; rua=mailto:dmarc-reports@yourdomain.com; adkim=r; aspf=r;
Fix 4: Do not let Cloudflare Email Routing rewrite your Return-Path
Cloudflare Email Routing rewrites the MailFrom (Return-Path) domain to route bounces through Cloudflare. This breaks SPF alignment because the RFC5321.MailFrom domain no longer matches your From domain.
Either disable Email Routing for domains you send authenticated email from, or add Cloudflare's servers to your SPF record as authorized senders.
How to monitor alignment failures going forward
After you apply fixes, check your DMARC aggregate reports. These are sent to the rua address you specified in your DMARC record. Each report tells you:
- Which source IPs are sending email for your domain
- Whether each source passed or failed SPF, DKIM, and alignment
- Which sources are still causing DMARC failures
DMARCFlow parses these reports and surfaces the specific source IPs and domains that are failing alignment. When you have multiple internal systems or third-party senders, each with their own sending configuration, parsing aggregate reports manually becomes error-prone. DMARCFlow handles this automatically.
FAQ
Does passing SPF mean my domain is safe from spoofing?
No. Passing SPF only means the sending server was authorized. Anyone who can send from an authorized server can pass SPF. DMARC alignment closes that gap by also checking that the visible From domain matches.
Can alignment fail even when DKIM is valid?
Yes. If your DKIM signature uses a different domain than your From header, alignment fails even if the signature itself is cryptographically valid. DKIM can pass while DMARC fails.
What does "alignment: none" mean in a DMARC report?
It means the sending domain is not aligned with your From domain, but the DMARC policy was not applied because no authentication mechanism passed. If both SPF and DKIM fail authentication, DMARC has nothing to align, so it returns "none" rather than pass or fail.
My DMARC record is p=none. Should I change it?
p=none means you are monitoring only. It does not block anything. Once you have resolved all alignment failures and verified that legitimate sources are passing, move to p=quarantine (mark failures as spam) and eventually p=reject (block failures entirely). Do not skip the monitoring phase.
Summary
The reason SPF and DKIM pass but DMARC fails is always alignment. The From header domain does not match the domain that SPF or DKIM verified.
In a Microsoft 365 + Cloudflare DNS setup, this commonly happens because: - DKIM is signing with the outlook.com domain instead of your custom domain - Cloudflare Email Routing is rewriting the Return-Path - Your custom domain is not fully verified in Microsoft 365
Fix it by enabling DKIM for your custom domain, publishing the correct CNAME records in Cloudflare, and checking that Cloudflare Email Routing is not rewriting your envelope sender.
Once fixed, use DMARC aggregate reports to confirm alignment is passing across all your sending sources. DMARCFlow makes this faster by showing you exactly which source IPs are still failing, without requiring you to parse XML.