Blog · Dmarc
Why DMARC Fails Even When SPF and DKIM Both Pass
You have set up SPF. You have signed your emails with DKIM. And yet your DMARC reports show failures. The reason is simple: DMARC checks alignment, not just authentication. SPF and DKIM can both pass while DMARC still fails, because passing authentication is not the same as passing alignment.
The confusion is so common that it is the top reason practitioners contact DMARCFlow support. They see authentication passing in their DMARC aggregate reports while DMARC itself still fails, and they assume something is broken. It is not broken. It is working exactly as designed, and alignment is the missing piece.
The Difference Between Authentication and Alignment
Think of it this way. SPF answers the question: "Is this server allowed to send for this domain?" It checks the envelope sender domain against the sending server's IP. DKIM answers: "Was this message signed by someone with the private key for this domain?" It checks the DKIM signature domain against the message headers. Both checks are about whether the sending infrastructure is authorized.
Alignment asks something different: "Does the domain that authenticated this message match the domain in the From header that the recipient actually sees?"
The From header is what the recipient sees. If the authenticated domain and the From header domain are not the same, DMARC considers that a mismatch. A message passes DMARC when at least one of SPF or DKIM both passes AND aligns with the From header domain.
How DMARC Evaluation Works
When a receiving server processes an inbound message, the order is:
- Check the DKIM signature. If present and valid, DKIM passes.
- Check SPF for the envelope sender domain. If the IP is authorized, SPF passes.
- Check alignment for any passing authentication results. Does the DKIM signature domain match the From header domain? Does the SPF envelope domain match the From header domain?
- If at least one aligned authentication result exists, DMARC passes. If neither SPF nor DKIM aligns with the From header domain, DMARC fails and the domain's published DMARC policy is applied.
The four possible outcomes are:
- SPF aligned and DKIM aligned: DMARC pass
- SPF aligned only: DMARC pass (one is enough)
- DKIM aligned only: DMARC pass (one is enough)
- Neither aligned: DMARC fail
The third and fourth rows trip up most people. A message can fail DMARC because DKIM passes but the signing domain does not match the From header domain. Or because SPF passes but the envelope sender domain differs from the From header domain.
Relaxed vs Strict Alignment
There are two alignment modes, set in your DMARC record with the adkim and aspf tags.
Relaxed alignment (r) treats subdomains as aligned with their parent domain. If your From header is example.com and the DKIM signature is signed by mail.example.com, those are considered aligned under relaxed mode. This is the default and works for most organizations.
Strict alignment (s) requires an exact domain match. The same scenario would result in an alignment failure under strict mode. Strict alignment sounds more secure, but it will reject legitimate mail if any of your sending systems use a subdomain that is not explicitly included in your DKIM or SPF setup. Most organizations should stay with relaxed alignment unless they have a specific reason to do otherwise.
The Most Common Reasons DMARC Fails When SPF and DKIM Pass
Third-party senders using their own domain
Marketing platforms, CRM systems, billing software, and support tools often send through their own infrastructure. Their servers send from their own domain, not yours. If they are not configured to send on your behalf using your domain, both SPF and DKIM pass for their domain, not yours. Your From header shows your domain. The authenticated domain is theirs. No alignment. DMARC fails.
This is the most common alignment failure in practice. The solution is to use a custom sending domain that you control, rather than letting the vendor send from its own domain.
Shared mail servers and forwarding
When mail passes through a shared relay or forwarding service, the envelope sender domain is often rewritten to the relay's domain. SPF passes for the relay's domain. DKIM may or may not survive depending on whether the relay modifies headers. Alignment with your From header domain breaks because the authenticated domains belong to the relay, not you.
Subdomains not covered by SPF or DKIM
If a subdomain like alerts.example.com sends mail but is not included in your SPF record and does not have its own DKIM key, messages from that subdomain fail both authentication and alignment. Even if you add the subdomain to your SPF record, if it uses a different DKIM selector than your main domain, DKIM alignment can still fail because the signing domain does not match the From header domain.
Switching to strict alignment without auditing your senders
Organizations sometimes enable strict alignment expecting tighter security, only to find that perfectly legitimate mail starts failing DMARC. This happens because any sending system using a subdomain that is not an exact match to your base domain will break under strict mode. If you want to test strict alignment, audit every legitimate sending source first and confirm all are using your exact organizational domain.
How to Read Your DMARC Reports to Find Alignment Failures
Your DMARC aggregate reports (sent to the address in your rua tag) tell you exactly what is failing and why. The key fields to look for are the spf_result, dkim_result, spf_aligned, and dkim_aligned values for each message batch.
A result of "pass" on SPF or DKIM alongside "fail" on the corresponding alignment check is a clear misalignment signal. It means the authentication check passed, but the authenticated domain did not match your From header domain.
Most aggregate reports arrive as XML files, which are not easy to read manually. DMARCFlow parses these reports and surfaces the alignment data in a structured format, making it easier to distinguish alignment failures from authentication failures. This distinction matters: alignment problems require changing how mail is sent or how DKIM is signed, not just adjusting DNS records. Understanding which category your failures fall into before you start troubleshooting is the difference between a targeted fix and a random walk through your email infrastructure.
Without a tool that presents this clearly, administrators often misread aggregate reports and try to fix authentication problems when the real issue is alignment.
How to Fix Alignment Problems
Use a custom sending domain for third-party platforms
Configure your marketing platform, CRM, or other third-party sender to send from a subdomain you control, such as emails.example.com, rather than from the vendor's own domain. Add this subdomain to your SPF record and sign it with your DKIM key. The From header still shows your main domain, but now the authenticated domain is also yours, and alignment passes.
Match your DKIM signing domain to your From header domain
Many ESPs sign with their own domain by default. Check your DKIM selector configuration and ensure the signing domain matches your organizational domain exactly. If you have multiple sending domains, each needs its own DKIM key and selector.
Audit your SPF record for all legitimate subdomains
Run a full inventory of every subdomain that sends mail. Add each one to your SPF record or confirm that your SPF record already covers it through an include statement or wildcard. Missing subdomains fail SPF, and if they also do not match your From header domain, they fail DMARC twice.
Keep relaxed alignment unless you have a specific reason not to
Relaxed alignment handles subdomain variation without breaking. Move to strict alignment only after auditing all legitimate senders and confirming none of them depend on subdomain sending that would be excluded by an exact match requirement.
Quick Reference Table
| Authentication result | Alignment result | DMARC outcome |
|---|---|---|
| SPF aligned, DKIM aligned | both pass | DMARC pass |
| SPF aligned only | DKIM fails or not present | DMARC pass |
| DKIM aligned only | SPF fails or not present | DMARC pass |
| SPF pass but not aligned | DKIM fail or not present | DMARC fail |
| DKIM pass but not aligned | SPF fail or not present | DMARC fail |
| Both fail alignment | neither authenticates | DMARC fail |
When neither SPF nor DKIM aligns with your From header domain, the receiving server applies your published DMARC policy, which may be none, quarantine, or reject.
Common Mistake to Avoid
The most frequent error is assuming that because SPF passes or DKIM passes, everything is working. If you see authentication results passing while DMARC still fails in your aggregate reports, look at the alignment fields. Alignment is almost always the missing piece.
DMARC aggregate reports are the authoritative source for understanding what is actually happening with your mail. Review them regularly, and treat alignment failures as a distinct problem class from authentication failures.
Quotable statement: "Strict alignment sounds more secure, but it will reject legitimate mail if any of your sending systems use a subdomain that is not explicitly included in your DKIM or SPF setup. Most organizations should stay with relaxed alignment unless they have a specific reason to do otherwise."
Quotable statement: "The single fastest way to fix third-party sender alignment is to use a custom sending domain that you control, rather than letting the vendor send from its own domain."