How to Fix DMARC Alignment for Third-Party ESP

Your email service provider says DKIM is set up correctly. Your DMARC aggregate reports still show DKIM failures every time the ESP sends email for your domain.

Here is the short version: DKIM proves that SendGrid (or whoever your ESP is) is authorized to send email from SendGrid's own servers. It does not prove they are authorized to send email from yourdomain.com. DMARC requires that second part, and that is where ESP sending commonly breaks.

The longer version is below.

Why Your ESP DKIM Signature Does Not Automatically Satisfy DMARC

DKIM works by attaching a cryptographic signature to your message. The signature carries a domain identifier in the "d=" field of the DKIM header. When a recipient's mail server verifies the signature, it checks whether that "d=" domain matches the domain in your From header.

That matching requirement is DMARC alignment.

For DMARC to pass, one of these must be true:

SPF alignment: the domain used in the SMTP envelope (MAIL FROM) matches the From header domain
DKIM alignment: the "d=" domain in the DKIM signature matches the From header domain

A DKIM signature with "d=sendgrid.com" does not align with a message where the From header says "from=sender@yourdomain.com". The signature can be cryptographically valid and still fail DMARC alignment, because the domains do not match.

This is not a flaw in DMARC. It is the mechanism that prevents anyone with a valid DKIM key for their own domain from sending email that appears to come from your address.

The Three Ways to Fix ESP DMARC Alignment

Option 1: Custom DKIM Signing (Best)

Ask your ESP to sign emails using a DKIM selector published in your own DNS rather than theirs. The ESP adds a DKIM record to your DNS namespace, then signs with "d=yourdomain.com" instead of "d=espdomain.com".

When this is configured, the DKIM "d=" domain matches the From header domain automatically. The physical sending server is irrelevant -- what matters is that the signing domain matches your From domain.

Major ESPs that support custom DKIM signing:

SendGrid

Amazon SES

Mailgun

Mailchimp (via custom domain sending)

Postmark

SparkPost

Each provider has slightly different setup steps, but the pattern is the same: publish a CNAME record in your DNS pointing to the ESP's DKIM selector, then confirm with the provider that they are now signing with your domain. You can verify it is working by checking the DKIM-Signature header in an outgoing message -- the "d=" parameter should show your domain.

Option 2: Subdomain Delegation

Send your ESP-mediated email from a subdomain you control, such as marketing.yourdomain.com or send.yourdomain.com. Keep the root domain for direct human-to-human email where you control everything end-to-end.

In this setup, your root domain publishes the DMARC record. The subdomain publishes its own SPF record that includes the ESP's sending IPs, and the ESP publishes a DKIM key for the subdomain. Because the From header (marketing@yourdomain.com) and the DKIM "d=" domain (marketing.yourdomain.com) match, alignment passes.

This approach isolates ESP sending from your primary domain's authentication posture. If the ESP misbehaves or misconfigures something, it affects the subdomain, not your main brand domain.

Option 3: SPF Fallback (Limited)

Include the ESP's sending IPs in your SPF record. This handles SPF alignment but does nothing for DKIM alignment, so it only helps if DKIM is also configured correctly for your domain.

The practical problem is the 10-DNS-lookup SPF limit. High-volume ESPs often use dozens of sending IPs across multiple IP ranges. Adding all of them to your SPF record can exceed the limit, causing all SPF checks to return permerror -- which breaks more than it fixes.

Only use this option when your ESP uses a small, stable set of IPs and you have verified you will not hit the lookup limit.

How to Validate Alignment Before Moving to p=reject

Do not raise your DMARC policy to p=reject until you have confirmed alignment is working. Here is how to check:

Step 1: Send a test email through the ESP. Use an external inbox you control so you can inspect the raw headers.

Step 2: Find the DKIM-Signature header. The "d=" parameter tells you which domain is being signed. If it shows yourdomain.com, custom DKIM is working. If it shows the ESP's domain, alignment will fail for messages with that From address.

Step 3: Check the Return-Path header. The Return-Path (envelope MAIL FROM) should show yourdomain.com if you are using the subdomain approach or have your own MAIL FROM domain configured. If it shows the ESP's domain, SPF alignment will fail.

Step 4: Review your DMARC aggregate reports. The source IPs listed should match the ranges your ESP says they send from. Unexpected IPs in the report usually mean the ESP is also sending through infrastructure you have not accounted for -- shared CDN routes, backup providers, or acquired sending services.

Step 5: Watch for sudden changes in failure rates. If your ESP adds new sending infrastructure without telling you, your DMARC failure rate will spike. This is one of the most common causes of unexpected rejections after a policy raise: the ESP quietly added IPs and you did not update your authentication configuration.

This is where DMARCFlow is specifically useful. Standard DMARC aggregate reports show failure counts by source IP but do not automatically flag when a trusted vendor adds new sending infrastructure. DMARCFlow tracks your ESP IP ranges over time and alerts you when a new IP appears in your reports, before that new infrastructure causes alignment failures at recipient servers. It also groups ESP-related failures separately from other failure sources, so you can see at a glance whether your ESP is the source of a spike.

FAQ

Q: Our ESP says their DKIM is "configured" but DMARC still fails. What do I tell them?

Tell them the DKIM key is signed for their domain, not yours. Ask specifically whether they can sign with your From domain rather than their own. If they cannot or will not support custom DKIM selectors, ask about subdomain delegation. If neither option is available, your ESP is not compatible with strict DMARC enforcement on your primary From domain, and you need to plan around that constraint.

Q: We use multiple ESPs. How do we handle each one?

Each ESP needs its own alignment path. For custom DKIM senders, each ESP gets its own DKIM selector in your DNS. For subdomain delegation, each ESP gets its own subdomain. Keep the mapping one-to-one: one ESP per subdomain. Merging multiple ESPs under the same subdomain complicates troubleshooting and your SPF record.

Q: The ESP uses shared IP pools. Does that affect alignment?

No. Alignment is about domain matching, not IP reputation. A shared IP pool used by thousands of senders does not affect whether your DKIM signature aligns with your From domain. Shared IP reputation matters for spam filtering, but DMARC alignment is purely a domain name check.

Q: We moved to p=reject and now ESP emails are rejected. What do we do?

Roll back to p=quarantine immediately. Fix the DKIM or SPF alignment first. Once your DMARC reports show zero alignment failures from the ESP for at least one full reporting period (usually 24 to 48 hours), you can safely raise the policy again.

Q: Does ARC replace the need for proper alignment?

No. ARC preserves authentication results through intermediate servers but it does not satisfy DMARC alignment requirements. A message that fails DMARC at final delivery still fails DMARC. ARC is useful for maintaining deliverability through forwarding chains, not as a substitute for getting alignment right.