SPF and DKIM Pass But DMARC Fails: Alignment Explained

Why SPF and DKIM Pass But DMARC Fails: Understanding Email Alignment

When SPF and DKIM both show pass but DMARC still fails, the issue is almost always alignment. DMARC does not just check whether SPF and DKIM pass individually. It checks whether they pass AND whether the domains they validated match the From header domain. If that alignment is missing, DMARC rejects the message even when both authentication protocols are technically working.

This catches people off guard because SPF and DKIM tools often report "pass" without mentioning alignment. You get a green result from one check and a green result from another, so it seems like everything should work. DMARC is the one that says something is still wrong.

The Three-Way Check DMARC Actually Performs

DMARC requires three things to pass for a message to authenticate successfully:

1. SPF passes (the sending server is authorized for the envelope-from domain)
2. DKIM passes (the message was signed by the domain's private key)
3. The domains validated by SPF and DKIM are aligned with the From header domain

Alignment means the domain in the authentication result matches the domain a human sees in their email client as the sender. Without that match, DMARC fails even when the first two checks pass.

What Alignment Actually Means

There are two types of aligned authentication:

Aligned SPF: The envelope-from domain (the MAIL FROM domain used in the SMTP conversation) matches the From header domain, or is an exact subdomain of it.

Aligned DKIM: The domain in the DKIM signature's "d=" tag matches the From header domain, or is an exact subdomain of it.

Here is a concrete example of what alignment looks like in practice:

You send an email from "newsletter@company.com" using your marketing platform. The marketing platform sends from its own envelope domain, such as "mailserv.example.com". Even if example.com has perfect SPF and DKIM, the envelope-from domain does not match the From header domain. SPF might pass for example.com, but it is not aligned. The same applies to DKIM if the signature domain differs from the From domain.

In a working alignment scenario, both the envelope-from and DKIM domain match the From domain exactly. When that happens, DMARC sees consistent identity across all three layers and passes.

Why Forwarding Breaks DMARC Alignment

Forwarding is the most common cause of alignment failures in the real world. Here is the mechanism:

When an email is forwarded, the original recipient's mail server becomes the new sender. It issues a new SMTP conversation with the next hop. This means the envelope-from is rewritten to the forwarder's domain. The original SPF check was against the original sender's SPF record, but now the forwarded message is coming from the forwarder's IP. The forwarder's SPF record applies, not the original sender's.

If the forwarder has a relaxed alignment policy (as most do), alignment may still pass if the forwarder's envelope domain is a subdomain of the original From domain. But if the forwarder uses a completely different domain, alignment fails even though the original message had valid SPF and DKIM.

DKIM is more resistant to forwarding but not immune. If the forwarding process modifies the message body or headers in ways that break the DKIM signature, DKIM fails outright. If the signature survives but the d= domain in the signature does not match the From header (because the original sender was using a subdomain that got lost or rewritten), alignment fails.

This is why forwarded newsletters often land in spam despite the sender having correct SPF, DKIM, and DMARC configuration. The forwarding chain breaks the alignment chain.

Other Common Alignment Failures

Third-party email senders: Marketing platforms, CRM systems, and billing software often send from their own infrastructure. They may have valid SPF for their own domain and valid DKIM for their own domain, but those domains do not match your From header. Your DMARC policy sees the mismatch and fails the message.

Subdomain misalignment: If your SPF record authorizes "mail.cluster.mx.net" and your DKIM uses "mx.net" but your From header shows "company.com", none of those domains align with each other. SPF, DKIM, and DMARC all see different domains.

Shared infrastructure: When multiple tenants share the same sending infrastructure, the envelope-from often defaults to the provider's domain rather than the customer's. This breaks alignment for any tenant using a custom From domain.

SPF softfail without noticing: If your SPF record has a ~all (softfail) qualifier instead of -all (fail), your DMARC policy may be set to quarantine or reject, but some receivers treat softfailed SPF as an alignment failure even when the mechanism technically passes.

How to Diagnose Alignment Problems

The primary tool for diagnosing alignment failures is your DMARC aggregate (RUA) reports. These reports show every domain sending on your behalf and whether each authentication result was aligned. Look for entries where SPF and DKIM show pass but the disposition shows quarantine or reject. Those are your alignment failures.

In the auth-res-ults header fields you can see directly:

`smtp.auth` result: the SPF check result for the envelope-from
`dkim.auth` result: the DKIM signature check result
`dmarc.result`: the combined DMARC decision

The alignment status is inferred by comparing the domains. If the d= domain in the DKIM signature or the envelope-from domain differs from the From header domain, alignment is broken.

DMARCFlow parses these reports and surfaces alignment failures specifically, showing you which sending domains are producing unaligned results and exactly how each domain's authentication compares to your From header. Without that, you are reading raw XML to find the affected message flows manually.

How to Fix Alignment Problems

For forwarding scenarios: Switch to DKIM-only alignment by setting adkim=s in your DMARC record and ensuring all legitimate senders sign with DKIM keys tied to your From domain. This removes the SPF alignment requirement, which is the part that forwarding breaks.

For third-party senders: Configure your third-party platform to send using your domain in the From header and sign with DKIM keys from your domain. Many platforms call this "custom domain sending" or "white-label sending." If your platform does not support this, you need to either move to one that does or accept that those messages will fail DMARC.

For subdomain issues: Audit every sending domain in your SPF record. If you have include mechanisms that point to third-party platforms, verify that those platforms also use your domain (or a subdomain of it) for their envelope-from and DKIM signing. Any include that resolves to a different root domain breaks alignment.

For mailing list operators: Implement RFC 8615 (Author Domain Signing Practices, ADSP) or use List-ID headers so forwarders can identify your mailing list traffic and exempt it from normal alignment requirements. Some forwarders honor ADSP, though support is inconsistent.

For a quick alignment check: Use DMARCFlow's lookup tool to see exactly how your domain's authentication results will appear to receiving mail servers. This tells you whether alignment is likely to pass before you change your DNS records.

Quick Checklist for Troubleshooting

Check your DMARC aggregate reports for patterns where SPF=pass and DKIM=pass but disposition is not "none"
Verify that every include mechanism in your SPF record uses your own domain or a recognized subdomain
Confirm that all DKIM selectors used by your senders include your From domain in the d= field
Identify forwarded message streams and switch them to DKIM-only alignment (adkim=s)
Verify that any third-party sender is using your domain in both the envelope-from and DKIM signature
Test changes in a limited scope before rolling out p=reject globally

FAQ

Can SPF pass but still break DMARC alignment?

Yes. SPF can pass for the envelope-from domain, but if that domain does not match the From header domain, alignment fails. This is common with third-party senders and forwarded messages.

Does DKIM survive forwarding?

Usually, but not always. If the forwarding process modifies headers or body in ways that break the cryptographic signature, DKIM fails outright. If the signature survives but uses a different domain than the From header, alignment fails.

What is relaxed vs. strict alignment?

Relaxed alignment (adkim=r) allows subdomains to match. If the envelope-from or DKIM domain is "mail.company.com" and the From header is "company.com", relaxed alignment treats this as aligned. Strict alignment (adkim=s) requires exact domain matches only.

Does p=quarantine require alignment to pass?

Yes. Both p=quarantine and p=reject require alignment. The policy only controls what happens to messages that fail DMARC, whether through alignment failure or a missing SPF/DKIM result.

How do I test if my DMARC alignment is correct?

Send a test message to a known good inbox and check the auth-res-ults headers in the message source. Look for the SPF, DKIM, and DMARC results and verify that the domains in each authentication check match your From header domain.