Why DKIM and SPF Pass But DMARC Fails: Alignment Explained

The confusion that trips up every email admin

You check your email headers. SPF says pass. DKIM says pass. But DMARC says fail. The first time this happens, it feels like a contradiction. It is not. SPF and DKIM verify that an email was sent by an authorized server or signed by a valid key. DMARC verifies that the domain which passed those checks matches the domain users see in their inbox. When those two domains are different, DMARC fails even when both authentication checks pass.

The word that matters is alignment.

Authentication versus alignment

Email authentication has two separate stages.

SPF and DKIM are authentication mechanisms. They check whether the server sending the email is allowed to do so, and whether the message carries a cryptographic signature. These checks operate on specific domains: SPF looks at the RFC5321 Mail From address (also called the envelope from or Return-Path). DKIM looks at the domain embedded in the DKIM signature header.

DMARC is a policy layer. It asks: did the domain that passed SPF or DKIM also match the domain in the From header, the address users actually see when they read the email? If the answer is no, the message fails DMARC regardless of whether SPF or DKIM passed.

This distinction matters. A message can be perfectly valid from an authentication standpoint and still fail DMARC because the From header domain does not match the authenticated domain.

The three possible outcomes

When SPF and DKIM produce their results, DMARC has three paths.

If SPF passes and aligns, DMARC passes. If DKIM passes and aligns, DMARC passes. If neither SPF nor DKIM passes with alignment, DMARC fails. The key variable is whether alignment occurred, not whether the checks passed on their own.

In practice, this means most DMARC failures fall into two categories. Either SPF passed but the Mail From domain did not match the From header. Or DKIM passed but the domain in the DKIM signature did not match the From header.

Why DKIM passes but alignment fails

Third-party email services are the most common cause of DKIM alignment failures.

When you send email through SendGrid, Mailgun, Amazon SES, or any bulk email provider, the DKIM signature is usually applied using the provider's domain, not yours. The signature is valid. The cryptographic check passes. But the domain in the DKIM signature is sendgrid.net or similar, while your From header says @yourcompany.com. Those domains do not match. Alignment fails. DMARC fails.

The fix is to set up custom DKIM signing. Most major providers let you add your own domain as the DKIM selector so the signature carries your domain instead of theirs. Once your DKIM signature uses your domain, it aligns with the From header and DMARC passes.

Some providers do not offer custom DKIM signing at lower tiers. In that case, the only reliable option is to switch to a provider that does, or to route sending through your own mail infrastructure with proper DKIM signing configured.

Why SPF passes but alignment fails

SPF checks the Mail From domain, which is separate from the From header domain.

When you fill out a contact form on a website and it sends you an email, the Mail From is often rewritten to something like noreply@webserver.yourhostingprovider.com. SPF may authorize that server correctly. The email arrives in your inbox showing your domain in the From header, but the SPF check ran against the hosting provider's domain. The domains do not align. DMARC fails.

Email forwarding causes a similar problem. When Gmail forwards a message to your Outlook address, it often rewrites the Mail From to something like mailer-different-provider.com. SPF passes because Gmail's servers are authorized for that domain. But the From header still shows the original sender. Alignment fails.

Forwarding-related alignment failures are expected behavior in many cases. They do not necessarily indicate a problem with your email configuration. But they do mean that forwarded messages may land in spam or fail DMARC if the destination server applies strict checks.

Relaxed versus strict alignment

DMARC alignment has two modes. Relaxed alignment treats subdomains as valid. If the From header is @company.com and the authenticated domain is @mail.company.com, relaxed alignment passes. Strict alignment requires an exact match. Only @company.com matches @company.com. Subdomains fail.

Many organizations set p=strict without realizing what they agreed to. If any part of your email infrastructure sends from subdomains, strict alignment will cause failures. If you are not sure which mode you are using, check your DMARC record. The aspf tag controls alignment mode: aspf=r means relaxed, aspf=s means strict.

For most organizations, relaxed alignment is the practical choice. It accommodates legitimate multi-domain sending without requiring every subdomain to have its own SPF record and DKIM key.

How to check alignment manually

The Authentication-Results header in any email message contains everything you need.

Open the raw email headers. Look for Authentication-Results. Find the SPF result. It will show the Mail From domain that was checked. Find the DKIM result. It will show the domain in the DKIM signature. Find the From header. Extract the domain after the @ symbol.

Then ask: does the SPF domain match the From domain? Does the DKIM domain match the From domain? If either matches exactly (strict) or as a parent subdomain (relaxed), that mechanism aligns. If neither aligns, DMARC will fail unless the failure is overridden by a forwarding scenario that created a new alignment path.

This manual process works for debugging individual messages. For ongoing monitoring, reading Authentication-Results headers across thousands of emails is impractical.

How to catch alignment failures before they become deliverability problems

Most alignment failures go unnoticed until someone reports missing email. By then the problem has already affected recipients.

DMARCFlow reads your aggregate (RUA) and failure (RUF) reports and flags alignment failures automatically. When a third-party service starts sending with its own DKIM domain instead of yours, DMARCFlow surfaces it as a DKIM alignment failure in the dashboard. When a platform change breaks DKIM signing and the signing domain stops matching your From header, DMARCFlow shows the drop before you start getting complaints.

The most useful signal in the reports is the authenticated domain that failed to align. That field tells you exactly which sending infrastructure is using a domain that does not match your From header. If it is a third-party service you control, the fix is custom DKIM signing. If it is a forwarder or mailing list, the fix is usually to rely on DKIM alignment rather than SPF alignment for that traffic class.

Without a tool reading those reports, catching this requires manually reviewing Authentication-Results headers across every message. For any organization sending more than a few hundred emails a day, that does not scale.

Checklist: how to fix alignment failures

If DKIM alignment is failing:

Identify which sending service is applying its own DKIM signature instead of yours
Log into that service and configure custom DKIM signing with your domain as the selector
Publish the required DKIM TXT record in your DNS
Wait for DNS propagation then test a message
If the service does not support custom DKIM signing, evaluate switching to one that does

If SPF alignment is failing:

Identify whether the Mail From domain in failing messages matches your From header domain
For contact form and web-to-email scenarios, consider using your own mail server as the relay instead of the web host's relay
For forwarding scenarios, understand that this is expected behavior in most cases and focus on DKIM alignment as the reliable path
Check whether your forwarders are rewriting Return-Path and consider whether that traffic matters for your policy

If you are unsure which mechanism is failing:

Use a DMARC report analyzer to review aggregate reports from your configured RUA endpoint
Look for entries where SPF or DKIM shows pass but the aligned domain does not match your From domain
DMARCFlow automates this analysis and presents it as an alignment health dashboard

FAQ

Can DMARC pass if SPF and DKIM both fail?

Yes. DMARC requires at least one mechanism to pass with alignment. If DKIM fails but SPF passes and aligns, DMARC passes. If SPF fails but DKIM passes and aligns, DMARC passes. If both fail, DMARC fails. The critical variable is alignment, not the number of passing checks.

Does DKIM alignment use relaxed or strict matching by default?

Strict. The DMARC specification defaults to strict alignment for both SPF and DKIM. Organizations that want subdomain matching to count as aligned must explicitly set aspf=r in their DMARC record.

Why do forwarded emails fail DMARC even though SPF passes?

Forwarders often rewrite the Mail From (Return-Path) to their own domain. SPF passes because the forwarder's servers are authorized for their own domain. But the From header still shows the original sender, which does not match the forwarder's domain. This breaks alignment. The solution is to rely on DKIM alignment where possible, since DKIM signatures survive forwarding more reliably than SPF.

Does p=none enforce alignment?

Yes. DMARC alignment is checked regardless of policy. p=none means you receive reports but take no action on failures. Alignment is still evaluated. Many organizations at p=none discover alignment failures only through their aggregate reports.

Can a subdomain align with a parent domain in DMARC?

Yes, but only with relaxed alignment. With aspf=r in your DMARC record, mail.company.com aligns with company.com. With aspf=s (strict), only exact matches align.