When SPF and DKIM Pass But DMARC Fails: What It Means and What to Do

The short answer: No, not automatically. An email with passing SPF and DKIM but failing DMARC has authenticated - but that does not mean it is safe to trust. Here is why this happens and what to do about it.

The difference between authentication and alignment

SPF and DKIM verify the sending infrastructure. SPF checks that the mail server is authorized to send for the domain. DKIM cryptographically signs the message so the receiving server can verify it was not altered in transit. Both checks answer: "Did this email come from where it claims?"

DMARC alignment is different. DMARC does not run its own authentication check - it looks at what SPF and DKIM returned and asks: "Did these checks pass for the domain that actually appears in the message's From address?"

The From address is what the recipient sees. When SPF or DKIM passes for a different domain than the From address - for example, when a marketing platform sends on your behalf but the authentication domain does not match your brand domain - DMARC alignment fails.

This distinction matters because passing authentication without alignment is not the same as confirming the sender.

Why this happens: the main causes

From address mismatch: The most common reason. A message is sent through a third-party service - a CRM, marketing platform, support tool - that authenticates with its own domain. If the From address shows your brand domain but the authentication runs under the service's domain, SPF and DKIM pass but alignment fails.

Forwarding: When a message is forwarded, the original authentication may no longer align. The forwarding server receives the message and resends it, but SPF may pass for the forwarder's server instead of the original sender, and DKIM may break if the forwarded message was modified. The original From address stays the same, but the authentication domain changes.

Shared infrastructure: Some multi-tenant services send from shared IP addresses that authenticate under a domain that does not match the sender's From address. This is common with bulk email platforms and some SaaS tools.

Legitimate third-party senders: Transactional email services, CRM platforms, and other business tools often operate this way by design. Their DKIM keys live under their domain, not yours. If you use these services and want DMARC alignment to pass, you need to configure custom DKIM signing under your own domain.

Is the email malicious?

Usually no. In most cases, an SPF/DKIM pass with DMARC failure is not an attack - it is a misconfiguration or a legitimate third-party sender that was not set up for alignment.

But it can be used maliciously. If an attacker knows your domain uses third-party senders that are not aligned, they could send email from those same services with a spoofed From address. The authentication would pass because the service legitimately sent the message - but the From address would be forged. DMARC alignment failure is often the only signal that catches this.

That is why you cannot simply treat passing SPF and DKIM as "safe to trust."

What to do: a practical checklist

When your DMARC reports show SPF and DKIM passing but DMARC failing:

1. Identify the authentication domain: Look at the aligned domain in your DMARC reports. If it differs from your From domain, you have found the cause.

1. Determine if it is a known sender: Check if the sending infrastructure belongs to a third-party service you use. Look at the IP addresses in the report against your known senders.

1. Decide if alignment should be fixed: For your own domains and major brand communications, alignment should be the goal. Configure custom DKIM with your email service so your domain is the signing domain. For legitimate third-party senders you cannot reconfigure, consider using ARC (Authenticated Received Chain) to preserve authentication through forwarding.

1. Look for patterns: A single message with this pattern may be noise. A cluster of alignment failures from the same IP or service may indicate a misconfiguration you need to fix.

1. Use a DMARC report aggregator: Raw DMARC reports are difficult to interpret. DMARCFlow parses your aggregate reports and shows you exactly which sources are producing mixed authentication results - aligned DKIM passes alongside failed alignment - so you can identify which third-party senders need reconfiguration and which failures are one-off noise.

The bigger picture

SPF, DKIM, and DMARC work together as a three-part system. Authentication alone (SPF and DKIM) tells you a message came from an authorized server. Alignment (DMARC) tells you the authorized server actually represents the sender shown in the From address. Without alignment, you only have half the picture.

For most organizations, the goal is not just to pass authentication - it is to pass alignment too. That means moving toward DMARC p=quarantine or p=reject with fully aligned sending infrastructure. The reports showing SPF/DKIM pass but DMARC fail are the gaps standing between your current setup and that goal. DMARCFlow is designed to surface exactly this pattern: authenticated-but-unaligned sources that need attention before enforcement can safely be increased.

FAQ

Can an email be safe if SPF and DKIM pass but DMARC fails?
Yes, in many cases it is safe - but not automatically. It depends on why alignment failed. A known third-party sender with a misconfigured setup may be perfectly legitimate. An unknown sender with alignment failures may be exploiting a gap in your authentication.

Does this mean my email is being rejected?
Not necessarily. DMARC p=none collects reports without rejecting anything. p=quarantine causes receiving servers to treat the message as suspicious. p=reject causes rejection. The impact depends on your DMARC policy, not on whether alignment failures appear in your reports.

I use Microsoft 365 or Google Workspace - should I be worried?
If you use these platforms for your primary sending and have not added third-party senders, alignment usually passes. Problems typically appear when you add marketing platforms, CRMs, or other third-party tools that send from their own infrastructure.

How do I fix alignment failures?
The fix depends on the cause. For third-party senders, configure custom DKIM signing if your provider supports it, or reconfigure your sending setup to use your own mail infrastructure. Work with your IT team or email vendor to ensure your domain is the signing domain.