Why Your SPF Record Passes but DMARC Still Fails When Using Third-Party Email Senders

The exact problem you are looking at

You added the SPF include for Brevo, SendGrid, or Mailchimp. You added the DKIM record the platform gave you. SPF check shows pass. DKIM check shows pass. But your DMARC aggregate reports show failures and your emails are not landing in inboxes the way they should.

The issue is not your SPF record. The issue is that SPF and DMARC check different things.

SPF verifies that the server sending your email is authorized. DMARC checks whether the domain in the email headers aligns with the domain you claim to be sending from. Third-party platforms break this alignment in two specific ways. Here is how to diagnose and fix it.

Why SPF pass does not automatically mean DMARC pass

SPF checks the Return-Path header, also called the envelope from. This is the address where bounces go. DMARC checks whether that Return-Path domain aligns with the From header domain, which is the address your recipients see.

When your marketing platform sends an email, two things can happen that break alignment.

The Return-Path gets set to the platform's domain

Some platforms set the Return-Path to their own domain instead of yours. If your From header says yourdomain.com but the Return-Path becomes platform.com, DMARC sees two different domains. SPF passes for the platform's servers. But DMARC alignment fails because the domains do not match.

The DKIM signature comes from the platform's domain

DKIM adds a digital signature to your email headers. The signature is verified using a public key published under a selector domain. Most platforms sign with their own DKIM key, under their domain. Your DMARC record looks for a DKIM signature under your domain. When the platform signs with its own key, the DKIM signature is valid but the alignment fails.

This is the specific failure pattern you are looking at. SPF is fine. DKIM is fine. Alignment is broken.

What alignment actually means in the DMARC context

DMARC alignment has two modes. Relaxed alignment means the organizational domain must match. Your organizational domain is your registered domain without subdomains. So newsletter.yourdomain.com and yourdomain.com share the same organizational domain. Relaxed alignment passes.

Strict alignment means the domains must be identical. Subdomains do not count.

Most organizations use relaxed alignment. If you are using strict alignment and struggling with third-party senders, switching to relaxed is often the fastest fix.

Even relaxed alignment fails when the platform sets the Return-Path to its own domain. That is the root cause to fix.

The three things you need to get right

1. SPF: the right include statement

Your DNS must include the platform's sending servers. For Brevo, that is include:spf.brevo.com. For SendGrid, include:sendgrid.net. For Mailchimp, include:servers.mcsv.net.

But adding the include is necessary, not sufficient. If the Return-Path domain does not match your From domain, SPF passing alone will not fix DMARC alignment.

2. DKIM: the selector must be on your domain

Most platforms give you a DKIM record to publish under your own DNS. This is different from the platform's default signing. You must publish the record they provide to your DNS, under your domain.

If the platform signs with its own key by default, the DKIM signature shows the platform's domain in the d= tag. That breaks alignment even though the signature is cryptographically valid.

Brevo, SendGrid, and Mailchimp all support custom DKIM selectors on your domain. The setup steps differ by platform, but the principle is the same: the DKIM signature must be verifiable under your DNS.

3. From header: your brand domain

Your From header must show your domain. Most of the time it does. But some platforms offer sending options that modify the From address or use a shared platform address. Make sure your From header shows your exact domain and is not being overwritten by the platform's settings.

Quick checklist by provider type

Marketing email platforms (Brevo, Mailchimp, SendGrid)

• Add the platform SPF include to your DNS
• Set up custom DKIM signing under your domain
• Confirm your From header shows your domain
• Send a test email and check authentication headers

Transactional email (Postmark, Amazon SES, Mailgun)

• Configure the platform to use your domain as the Return-Path domain
• For Amazon SES, verify your DKIM signature uses your domain
• For Postmark, custom DKIM requires DNS configuration on your side

CRM platforms (HubSpot, Salesforce, Microsoft 365 scenarios)

• Check whether the platform sends through its own infrastructure or yours
• For Microsoft 365 relay with third-party apps, the Return-Path may show the app domain
• Review the platform's sending domain authorization settings

How to verify your fix is working

The fastest check is to look at your email authentication headers. Send a test to an address that displays full headers, or use a diagnostic tool.

Look for these three results:

• SPF: pass
• DKIM: pass (the d= tag in the DKIM-Signature header must show your domain, not the platform's)
• DMARC: pass

If SPF and DKIM pass but DMARC still fails, alignment is the problem. The DKIM d= tag tells you immediately whether the platform is signing with its own key instead of yours.

You can also use DMARCFlow's free DMARC Checker. Paste your domain and get a full authentication scan including From/Return-Path alignment status and DKIM selector configuration. It runs without an account and gives you results in seconds.

What to do when alignment cannot be fully fixed

Sometimes a platform constraint makes perfect alignment impossible. In those cases, the priority shifts from fixing alignment to getting visibility into who is sending for your domain.

Start with DMARCFlow monitoring

Even if alignment fails for some sources, DMARC aggregate reports tell you exactly which servers are sending for your domain. You see failures grouped by sending source. You see whether failures come from your known third-party platform or from something else. That visibility is what lets you distinguish between a configuration problem you can fix and a spoofing problem you need to block.

Use p=none as a monitoring step

Setting your DMARC policy to p=none stops DMARC from rejecting email while you work through alignment issues. You still receive full aggregate reports. You can watch the failure rates change as you fix configuration. Just do not leave it at p=none permanently.

Prioritize fixing the sources that matter most

Your DMARC reports show you which failing sources are sending the most volume. Fix those first. A third-party sender that generates 10,000 emails a day and fails alignment deserves more attention than one generating 50.

DMARCFlow monitoring aggregates reports across all your sending sources and flags the ones with the highest failure rates, so you are not digging through raw data to find the priority fixes.

FAQ

Why does SPF pass but DMARC fail even after adding the Brevo or SendGrid include?

Because SPF checks the Return-Path domain and DMARC checks whether the Return-Path aligns with the From header. If the platform sets Return-Path to its own domain instead of yours, SPF passes for the platform's servers. But DMARC alignment fails because the two header domains do not match.

What is the difference between Return-Path and From header?

The Return-Path (envelope from) is set by the sending mail server and determines where bounces go. The From header is what your recipients see as the sender address. They can be different. DMARC alignment requires them to match or be in the same organizational domain.

Can forwarding break DMARC alignment?

Forwarding can cause DMARC failures, but through a different mechanism. When a message is forwarded, the forwarding server becomes a new sender. If that server is not in your SPF record, SPF fails. Forwarding does not break alignment the way third-party senders do. The standard fix for forwarding-related failures is ARC (Authenticated Received Chain), not SPF or DKIM changes.

How do I check which DKIM selector my emails are using?

Look at the DKIM-Signature header in your email. The 'd=' tag shows the domain used for the DKIM signature. If it says sendgrid.net instead of yourdomain.com, the email is being signed with the platform's key, not yours.

Is relaxed alignment secure enough?

Relaxed alignment protects against direct domain spoofing. An attacker cannot send an email with your domain in the From header and pass DMARC unless they also control a server authorized in your SPF or a DKIM key under your domain. Strict alignment closes a narrow edge case but relaxed is sufficient for most organizations.

What does DMARCFlow actually monitor?

DMARCFlow aggregates your DMARC aggregate reports and alerts you when new sending sources appear, when failure rates spike, and when your third-party senders consistently fail alignment. It helps you catch spoofing attempts and fix configuration problems before they affect deliverability.

TL;DR

Third-party email senders break DMARC alignment by setting the Return-Path to their own domain and by signing DKIM with their own selector instead of yours. Fix SPF includes, configure custom DKIM under your domain, and verify your From header matches your domain. Use DMARC aggregate reports or a free DMARC checker to confirm alignment is passing. If perfect alignment is not achievable with a given platform, use DMARCFlow monitoring to stay aware of what is sending for your domain and prioritize fixes by failure volume.