Why SPF and DKIM Pass But DMARC Fails: Receiver Disagreement Explained

The short answer

You checked DMARC at one receiver and it passed. At another, it failed. Same message, same authentication results, different outcome. The reason is usually alignment: SPF and DKIM passed at the protocol level, but the domain that was authenticated does not match the domain in the From header. Receiver differences in how they handle From header parsing, alignment modes, and forwarded mail produce different DMARC results from identical input.

Authentication vs. alignment: why DMARC checks both

SPF and DKIM are authentication mechanisms. They answer the question: was this message sent by a server authorized to send mail for this domain?

DMARC adds a second check: alignment. Alignment asks a different question: does the domain that was authenticated match the domain the recipient sees in the From header?

A message can pass SPF and DKIM but still fail DMARC if the authenticated domain does not match the From header domain. This is intentional. DMARC was designed to prevent spoofing - specifically the kind where the From address claims to be from your domain but was not actually authorized by your domain.

The three possible outcomes for a message:

• Pass both authentication and alignment: SPF or DKIM passed and the authenticated domain matches the From header. This is what DMARC wants to see.
• Pass authentication, fail alignment: SPF and DKIM might both pass, but the domains do not align. DMARC fails. This is common with forwarded mail and third-party senders.
• Fail authentication: SPF fails, DKIM fails, or both. DMARC fails regardless of alignment.

The confusing case is the middle one: authentication passes, alignment fails.

Why receivers can disagree on DMARC results

If one receiver says DMARC passed and another says it failed, the reason is usually one of three things.

From header reconstruction differences

The From header in an email has two parts: the display name and the email address. The email address is what matters for DMARC alignment. But not all receivers parse the From header the same way.

Some receivers handle quoted display names differently. Some handle Unicode domains (IDN) differently. Some apply case normalization, others do not. If your From header has any unusual formatting, one receiver might correctly extract the domain while another misparses it and concludes alignment failed.

Organizational domain vs. registering domain

DMARC alignment can use two modes: relaxed or strict. In relaxed mode, a subdomain aligns with its parent organizational domain. In strict mode, the domains must match exactly.

Most receivers default to relaxed alignment. But some enterprise email gateways can be configured to apply strict alignment by default, or may apply it inconsistently based on the message source. If you are sending from a subdomain and one receiver uses relaxed alignment while another uses strict, you get different results on the same message.

Forwarded or relayed mail

When a message is forwarded through a mailing list server or an email gateway, the transport changes. The forwarding server may:

• Change the Return-Path to its own domain (affecting SPF)


• Re-sign or strip the DKIM signature


• Add or modify headers

None of these changes break SPF or DKIM at the original receiving server, but they can break DMARC alignment at the final destination. A message that passed DMARC at the first receiver may fail at the mailing list subscriber's inbox provider because the forwarding server's changes broke alignment.

This is the most common cause of DMARC failures that appear at some receivers but not others, for legitimate mail. In your aggregate reports, you will see the mailing list server's IP address as the source of the failing messages - which is how you identify it as a forwarding artifact rather than a spoofing attack.

How DMARC aggregate reports reveal which receivers are failing your mail

When a receiver processes a message from your domain, it evaluates DMARC and generates a report. That report tells you:

• Whether the message passed or failed DMARC
• Which authentication check (SPF, DKIM) passed or failed
• The sending server's IP address
• The action the receiver took (delivered, quarantined, rejected)

If you are seeing DMARC failures at some receivers but not others, your aggregate reports show exactly which receivers are failing, which IPs are involved, and what the failure mode is. Without aggregation, you might check DMARC at one receiver and think everything is fine, while another receiver has been applying stricter alignment rules for weeks.

DMARCFlow is built for exactly this problem. It aggregates DMARC reports from all your receivers into a single view, so you can immediately see whether your DMARC status is consistent or whether specific receivers are consistently failing your mail. This is the only way to get a true picture instead of relying on a single receiver's result.

Common scenarios that produce this pattern

Mailing list forwarding

A mailing list server receives your message, rewrites the From header to the list's address, and forwards to subscribers. At the subscriber's inbox provider, SPF passes for the mailing list server (not your domain), DKIM may be stripped or re-signed by the list server, and the From header no longer matches your domain. DMARC fails.

This is benign for most organizations. Forwarded mail failing DMARC is expected behavior. Your aggregate reports will show consistent failures from mailing list server IPs - which is useful signal because it confirms the failures are from known forwarding infrastructure, not from spoofing.

Third-party email service providers

If you send marketing email or transactional email through a third-party provider, that provider sends from its own infrastructure with its own DKIM keys. If the From header domain is set to your brand domain but the email is DKIM-signed by the provider's domain, alignment fails unless the provider's DKIM selector is configured to sign on behalf of your domain.

This is a configuration problem, not an authentication failure. The fix is a custom DKIM configuration where your provider signs mail using your domain's DKIM selector.

Shared or forwarded infrastructure

Some organizations route all outbound mail through a shared relay or a forwarding service. When the relay changes the envelope or adds its own signatures, DMARC alignment breaks even though the original sending domain is legitimate.

How to check your DMARC status consistently

The right way to check DMARC is not to use a single online checker. It is to look at your aggregate reports from all receivers simultaneously.

If you do not yet have aggregate reports flowing:

1. Check your DMARC record is published: dig TXT _dmarc.yourdomain.com
2. Use two or three independent DMARC checkers and compare results. If they disagree, note which alignment mode each uses.
3. Look at your sending infrastructure: are you sending from the same domain in the From header that your SPF and DKIM are configured for?

If your aggregate reports show consistent failures from specific receivers:

1. Identify the failing receiver and the source IP
2. Determine whether the source IP is one of your authorized senders
3. If it is a legitimate third-party sender, configure that sender to authenticate on your behalf using custom DKIM
4. If it is a forwarding chain, assess whether the volume warrants adjusting your DMARC policy or documenting the expected failure
5. Re-check aggregate reports after 48-72 hours to confirm the failures are resolved

What to do when receivers disagree about your DMARC result

If one receiver shows DMARC passing and another shows it failing, do not assume the passing receiver is correct. Both might be correct based on their configuration. The question is not which receiver is right but why your domain's alignment is inconsistent across receivers.

Steps to resolve:

1. Pull your aggregate reports from all receivers. You need data from all of them, not just one.
2. Identify which receivers are failing and which authentication check is failing (SPF alignment, DKIM alignment, or both).
3. For each failing receiver, determine the cause: forwarding chain, third-party sender, subdomain issue, or misconfiguration.
4. Fix the cause: configure third-party senders with proper DKIM, address forwarding issues, or adjust your DMARC policy if the failures are benign.
5. Re-check aggregate reports after 48-72 hours to confirm the failures are resolved.

DMARCFlow consolidates reports from all receivers into a single view, making it obvious which receivers are applying stricter alignment and which are failing your mail - rather than requiring you to correlate data across multiple report inboxes.

FAQ

Why does DMARC fail when SPF and DKIM pass?
DMARC checks alignment separately from authentication. SPF and DKIM can both pass at the protocol level, but if the authenticated domain does not match the From header domain, DMARC fails. This is the alignment check and it is intentional - it is what prevents spoofing even when a message was technically sent by an authorized server.

Is DMARC failing at one receiver a problem if it passes at others?
It depends on the cause. If it is a forwarding chain or a misconfigured third-party sender, the failure is real and fixable. If it is a receiver applying stricter alignment rules than others, the failure may be legitimate behavior from that receiver. Aggregate reports across all receivers are the only way to know for sure.

What is the difference between authentication and alignment?
Authentication (SPF, DKIM) proves that a message was sent by an authorized server. Alignment (DMARC) proves that the From header domain matches the domain that was authenticated. Both must pass for DMARC to pass.

Can forwarded email cause SPF and DKIM to pass but DMARC to fail?
Yes. When a mailing list server forwards a message, it may change the envelope, strip DKIM signatures, or rewrite the From header. SPF and DKIM can pass at the list server level, but alignment fails at the final destination because the From header no longer matches the authenticated domain. Your aggregate reports will show the mailing list's IP as the source of the failures.

How do I check my DMARC status consistently across multiple receivers?
Aggregate DMARC reports from all receivers are the only consistent view. Individual online checkers test against their own receiver configuration and may not reflect what all your actual recipients see. DMARCFlow aggregates reports from all receivers so you can compare results in one place.

Does DMARC pass mean my domain cannot be spoofed?
DMARC with p=reject makes spoofing your domain at major receivers very difficult. At p=none, DMARC only monitors and does not block anything. At p=quarantine, suspicious mail is marked as spam but not blocked. Even with a strict policy, no email authentication standard prevents all spoofing in all scenarios, but DMARC at p=reject handles the vast majority of spoofing attempts at compliant receivers.