Why Does DMARC Fail When SPF and DKIM Both Pass?

Your SPF check passed. Your DKIM check passed. So why did DMARC fail?

This is one of the most common questions in email authentication, and the answer is not that something is broken. SPF and DKIM are authentication checks. DMARC is an alignment check. They measure different things, and passing one does not automatically mean you pass the other.

Authentication vs. Alignment: The Core Distinction

Think of it this way. SPF asks: "Is this server allowed to send mail for this domain?" DKIM asks: "Does this email have a valid cryptographic signature from this domain?" Both are yes-no authentication checks.

DMARC asks something different: "Did the domain in the From header -- the one the recipient actually sees -- align with the domain that authenticated this mail?"

That last part is the part people miss. The From header domain and the MAIL FROM domain are often the same, but they do not have to be. When they differ, DMARC alignment fails even if SPF and DKIM both passed on their own terms.

The From Domain vs. the MAIL FROM Domain

Every email has two sender domains that matter here.

The MAIL FROM domain (also called the envelope sender) is what the SMTP server uses for delivery. It rarely appears in the email header a human sees. It is mostly invisible infrastructure.

The From header domain is what the recipient sees as the sender address in their mail client.

These two domains do not have to match. A marketing platform might send mail where the MAIL FROM is ems.mtasv.net but the From header says newsletter@acmecorp.com. The SPF check authenticates ems.mtasv.net. The DKIM check might be signed by acmecorp.com. When DMARC evaluates alignment, it compares the From header domain against the domains that authenticated the mail. If neither authenticated acmecorp.com, DMARC fails.

This is the exact scenario behind the "SPF passed, DKIM passed, DMARC failed" confusion.

Relaxed Alignment vs. Strict Alignment

DMARC has two alignment modes, and they behave differently.

Relaxed alignment treats subdomains as valid. If the From header is newsletter.acmecorp.com and the authenticated domain is acmecorp.com, relaxed alignment passes.

Strict alignment requires an exact domain match. newsletter.acmecorp.com and acmecorp.com do not align under strict mode, even though they do under relaxed.

Most organizations use relaxed alignment because it accommodates legitimate mail infrastructure that spans multiple subdomains. Strict alignment is rare and often impractical for complex mail environments.

Both modes still require at least one of SPF or DKIM to pass alignment. Passing authentication alone is not enough.

A Worked Example

Here is the case that causes the most confusion: a third-party sending platform.


From header:    newsletter@acmecorp.com
MAIL FROM:      mail.sendingplatform.com
SPF domain:     sendingplatform.com   [PASS - not aligned]
DKIM domain:    sendingplatform.com   [PASS - not aligned]
DMARC:                                [FAIL]

Both SPF and DKIM pass -- but both authenticate sendingplatform.com, which does not match the From header domain acmecorp.com. Under relaxed alignment, these are different second-level domains, so neither check produces an aligned result. DMARC fails.

Now here is the same setup, but the platform is configured to DKIM-sign with the customer's domain:


From header:    newsletter@acmecorp.com
MAIL FROM:      mail.sendingplatform.com
SPF domain:     sendingplatform.com   [PASS - not aligned]
DKIM domain:    acmecorp.com         [PASS - aligned]
DMARC:                                [PASS]

DKIM alignment alone is sufficient. Because DKIM authenticates acmecorp.com and that matches the From header domain, DMARC passes even though SPF did not produce an aligned result.

This is why the distinction matters so much: you only need one aligned result, not both. The fix for "SPF pass, DKIM pass, DMARC fail" is often to get your third-party platform to DKIM-sign with your From header domain -- not to change your SPF or DKIM configuration broadly.

How to Read a DMARC Report to Find the Problem

When DMARC fails, your aggregate report tells you exactly why. Look for the result field in the section of the report.

The report will show:

SPF PASS or SPF FAIL for the MAIL FROM domain

DKIM PASS or DKIM FAIL for the signing domain

Whether each result was aligned or misaligned

The entry you want is something like: SPF PASS (aligned=no) or DKIM PASS (aligned=no). That tells you that authentication passed but alignment did not.

This is where DMARCFlow makes a practical difference. Rather than parsing XML reports manually, DMARCFlow presents alignment status for each domain in a readable format, showing which checks passed authentication and which of those also passed alignment. The alignment check is the one that actually determines whether DMARC passes.

For organizations running multiple third-party sending platforms, this distinction is critical. A platform that signs with your domain (aligned DKIM) is doing something fundamentally different from one that only passes SPF on its own infrastructure.

Common Causes of This Failure

Three patterns come up repeatedly:

Third-party sending platforms: Marketing tools, CRM systems, and bulk mail platforms often send from their own infrastructure while the From header retains your domain. This breaks SPF alignment. DKIM can fix it if the platform signs with your From header domain -- but only if it is configured to do so. Most platforms require explicit DKIM configuration per sender domain.

Shared mail infrastructure: When multiple domains share a single MTA, the MAIL FROM domain often defaults to the server hostname rather than the sender domain. SPF passes for the server, but alignment fails for the individual domains. The same setup can also cause DKIM alignment failures if the signing domain does not match the From header.

Forwarded mail: When mail is forwarded, the envelope sender changes to the forwarder's domain. The original SPF check passes on the original server, but alignment fails for the original From header. This is why forwarding frequently triggers DMARC failures, particularly when the forwarder also changes the signing keys.

FAQ

Can DMARC pass if SPF and DKIM both fail?
Yes. If either SPF or DKIM passes alignment, DMARC passes. You only need one aligned result. Many organizations pass DMARC because DKIM alignment compensates for SPF failures on specific mail streams.

Does DMARC require both SPF and DKIM to pass?
No. DMARC requires at least one aligned authentication result from either SPF or DKIM. It does not require both.

Does setting p=reject fix alignment failures?
No. p=reject tells receivers to discard mail that fails DMARC, but it does not change what alignment means or why failures happen. Setting p=reject without fixing alignment just causes more legitimate mail to be rejected.

Can relaxed alignment fix this automatically?
Relaxed alignment only helps if the misalignment is at the subdomain level. If your From header is acmecorp.com and your sending platform authenticates as sendingplatform.com, relaxed alignment does not fix it -- those are different second-level domains. The fix is getting the platform to authenticate your domain, not changing the alignment mode.

If DKIM aligns but SPF does not, does DMARC pass?
Yes. One aligned result is sufficient. If DKIM signs with your From header domain, DMARC passes regardless of SPF alignment.