Blog · Dmarc
Why DMARC Alignment Fails Even When SPF and DKIM Both Pass
Why DMARC Alignment Fails Even When SPF and DKIM Both Pass
The short answer: SPF and DKIM verify that an email came from an authorized server. DMARC alignment verifies that the authorized server is actually the one your recipients see in the From address. You can pass the first two checks and still fail the third.
This disconnect trips up almost everyone who sets up DMARC for the first time. The good news is that once you understand the distinction between authentication and alignment, the fix is usually straightforward.
Authentication vs Alignment -- What Is the Difference?
SPF (Sender Policy Framework) checks whether the mail server that sent your message is authorized to send for the domain in the envelope. The envelope domain is hidden from most recipients -- it is the Return-Path address that bounce messages go to.
DKIM adds a cryptographic signature to your message that proves it was not modified in transit and that it was signed by someone with access to your domain private key.
DMARC alignment is the step that ties authentication to your actual sender identity. It asks: does the domain that passed SPF or DKIM match the domain in the From header -- the address recipients see and reply to?
For DMARC to pass, at least one of the following must be true:
- The domain that passed SPF aligns with your From header domain (SPF alignment)
- The domain in a valid DKIM signature aligns with your From header domain (DKIM alignment)
You need only one. Both do not have to pass.
Why SPF and DKIM Passing Is Not Enough for DMARC
Here is a real scenario. You send an email through Mailchimp with the From address set to support@example.com. Mailchimp authenticates the message using its own infrastructure. The SPF check passes for mailchimp.com. The DKIM signature is valid for mailchimp.com. Both authentication checks pass.
But DMARC looks at your From header -- example.com -- and asks: does the authenticated domain match this?
Since mailchimp.com is not example.com, alignment fails. The message is legitimate -- it really came from Mailchimp -- but it is not genuinely from your domain. DMARC correctly flags it.
This is the concept most people miss. Authentication proves a message came from a particular service. Alignment proves that service was authorized to send on behalf of your brand.
What Causes Alignment to Fail When Authentication Passes
Third-party email senders. Any platform that sends email on your behalf -- marketing tools, CRMs, support software -- typically authenticates using its own domain. If your From address shows your domain, alignment fails unless the service has been configured to authenticate as your domain.
Mailing lists that rewrite headers. Some mailing list software modifies the From header or adds headers that break the original authentication chain. The message may have passed SPF and DKIM originally, but the rewritten version no longer aligns.
Forwarded email. When messages pass through forwarding chains, the original SPF check may apply to the wrong server, and DKIM signatures can break if headers are modified. This is a known limitation with no clean fix.
Internal relay or gateway servers. If your mail passes through an internal relay before going to the internet, that relay may be the SPF-authenticated entity, not your primary sending domain.
How to Diagnose Which Alignment Type Is Failing
Your DMARC aggregate reports tell you exactly what failed. The key fields to look for:
- SPF alignment failures: the Return-Path domain does not match your From domain
- DKIM alignment failures: the DKIM signing domain does not match your From domain
- Both failing simultaneously: almost always indicates a third-party sender that has not been configured to authenticate on your behalf
This is where DMARCFlow earns its place. Parsing aggregate reports manually means staring at XML files that can run thousands of lines. DMARCFlow automatically identifies which specific domains are causing alignment failures, presents them in a readable dashboard, and tracks trends over time so you know whether your fixes are working.
Common Scenarios That Break DMARC Alignment
Marketing email platforms. Services like Mailchimp, SendGrid, HubSpot, and others authenticate using their own domains by default. The solution is usually to set up custom DKIM signing -- adding a DKIM record under your own domain -- or custom SPF -- adding the service servers to your SPF record rather than letting them authenticate under theirs.
Shared inbox and collaboration tools. Tools that let team members send from a shared address often inject their own authentication that does not match your From domain. Check whether the tool supports custom domain authentication.
Legacy internal relays. Mail servers that have been in place for years may be adding Received headers or modifying envelopes in ways that break alignment. A DMARC report will show you exactly which hop is causing the mismatch.
How to Fix DMARC Alignment Failures
Step 1: Set p=none and monitor. Before changing anything, set your DMARC policy to p=none so you can see what is happening without blocking legitimate mail.
Step 2: Read your aggregate reports. Identify which senders are causing failures and whether they are alignment failures or authentication failures. This distinction determines the fix.
Step 3: Configure third-party senders. For each service causing alignment failures, set up custom DKIM or custom SPF so the service authenticates using your domain. Most major providers have step-by-step documentation for this.
Step 4: Track changes in DMARCFlow. After making configuration changes, monitor your reports to confirm alignment failures are decreasing. If a third-party sender is unwilling or unable to authenticate on your behalf, you may need to accept a portion of alignment failures or find an alternative service.
Step 5: Tighten policy gradually. Once alignment failures are resolved or understood, move from p=none to p=quarantine. Only move to p=reject when you are confident that all legitimate senders are properly authenticated.
How DMARCFlow Helps With Alignment Monitoring
Rather than downloading XML files and running scripts to parse them, DMARCFlow processes your aggregate reports automatically. You see:
- Which domains are failing alignment and why
- Which third-party senders need configuration changes
- Week-over-week trends in authentication and alignment rates
- A record of every change you make and its effect on your DMARC results
This is not just convenience. When you can see alignment failures in real time, you fix them faster and avoid the weeks of guesswork that manual parsing requires.
FAQ
Can DMARC pass if SPF fails but DKIM passes?
Yes. You need only one alignment check to pass. If DKIM alignment passes, DMARC passes even if SPF fails entirely.
Can DMARC pass if DKIM fails but SPF passes?
Yes. The same logic applies in reverse. SPF alignment alone is sufficient for DMARC to pass.
What is relaxed vs strict alignment?
Relaxed alignment allows subdomains to match your From domain. Strict alignment requires an exact match. Most organizations use relaxed alignment, which is the DMARC default.
My email service provider says DKIM is configured correctly. Why does alignment still fail?
They may have DKIM signed correctly for their own domain. You need the DKIM selector to be under your From domain -- not just your organizational domain. Check the DKIM record selector and verify it resolves under your exact domain, not a provider subdomain.
How long until I see alignment changes after fixing DNS?
Alignment takes effect on the next message sent after your DNS changes propagate. Aggregate reports typically arrive within 24-48 hours after processing.
Can forwarded email pass DMARC?
Not reliably. Forwarding chains often break SPF and DKIM in ways that cause alignment failures. The standard solution is ARC (Authenticated Received Chain), which preserves authentication results through forwarding, but not all services support it.