How to Fix DMARC Alignment Failures When a Third-Party ESP Sends Email for You

The problem in one sentence

Your third-party ESP sends email that shows your domain in the From header, but the DKIM signature attached to that email comes from the ESP own domain. DMARC alignment checks require those two domains to match, and when they do not, your email fails DMARC even though everything technically looks correct.

Why alignment fails

DMARC has two ways to authenticate an email: SPF and DKIM. Both check whether the sending server is authorized and whether the message signature is valid. But DMARC adds a second layer called alignment.

For DKIM, alignment checks whether the domain in the DKIM signature (the d= domain) matches the domain in the message From header. If you send from orders@yourdomain.com and the ESP signs with d=esp.com, those do not match. DMARC fails.

For SPF, the same logic applies. If the Return-Path domain (the envelope sender) does not match the From domain, alignment fails.

Most third-party ESPs are configured to sign with their own DKIM key by default. That means DKIM passes, SPF may pass, but DMARC alignment fails because the signing domain and the From domain are different.

This is not a bug in your DMARC record. This is a mismatch between how the ESP is configured and what DMARC requires.

This is where a monitoring tool like DMARCFlow earns its place. Most alignment failures are invisible without aggregate report analysis. You do not see the failures in your normal inbox. DMARCFlow parses those reports automatically and flags which IPs are failing alignment, so you know something is wrong without having to read XML.

How to diagnose the problem from your DMARC reports

If you have a DMARC record with an RUA (aggregate report) destination, you receive XML reports showing which IPs are sending as your domain and what their authentication results are.

Look for entries where:

• The From domain is yourdomain.com


• The DKIM result shows pass


• But the alignment shows fail

In a typical aggregate report, a DKIM alignment failure will show pass alongside an alignment result of fail. The first pass is the signature check; the second result is the alignment check. DMARCFlow surfaces this distinction directly rather than making you cross-reference individual XML fields.

If you do not yet have aggregate reports set up, that is the first step. Add a rua tag to your DMARC record:

v=DMARC1; p=none; rua=mailto:dmarc-reports@yourdomain.com;

Run this at p=none for at least a week before changing your policy. The reports show you exactly who is sending as your domain and whether they are passing alignment.

Fix 1: DKIM delegation (the recommended approach)

DKIM delegation means giving your ESP permission to sign emails with your DKIM key instead of their own. The ESP signs with your domain in the d= field, alignment passes, and DMARC succeeds.

The process depends on your ESP, but the general steps are:

1. Generate a DKIM key pair for your domain, or ask your ESP to generate one on your behalf.
2. Publish the public key as a DKIM TXT record on your domain, under the selector the ESP specifies.
3. Give the ESP the private key. Some platforms call this custom DKIM, branded DKIM, or BYO-DKIM.
4. Ask your ESP to switch from their default signing domain to your domain.

The main requirement is that your ESP supports custom DKIM or DKIM delegation. Most major marketing and transactional platforms support custom DKIM or BYO-DKIM setups. If yours does not, that is a signal to raise with your vendor or reconsider whether they belong in your sending infrastructure.

The tradeoff is key management: you are trusting the ESP with a private key tied to your domain. If the ESP is compromised or the key is not rotated regularly, your domain could be used to sign fraudulent email. Use a dedicated DKIM selector for ESP sends rather than your primary sending domain.

Fix 2: SPF-based sending without DKIM

If your ESP does not support DKIM delegation, the fallback is SPF. SPF alignment checks whether the Return-Path domain (the envelope sender) matches the From domain. If your ESP sets the envelope sender to your domain, SPF alignment can pass.

To use this approach:

1. Add the ESP's sending IPs or include mechanism to your SPF record.
2. Ensure the envelope sender (Return-Path) is set to your domain, not the ESP domain. This is sometimes called the bounce address or MAIL FROM domain.
3. Many third-party ESPs handle this automatically when you set up a custom sending domain. If yours does not, that is a signal to raise with your vendor or reconsider whether they belong in your sending infrastructure.

The limitation is that SPF has a 10-lookup limit. If you already have a complex SPF record with many includes, adding another ESP may push you over that limit and cause DNS resolution failures. Monitor your SPF record length.

Also, SPF only covers the envelope sender. If the From header domain and envelope domain differ in ways that cause alignment issues, SPF alone will not solve them.

Which fix should you use

DKIM delegation is the cleaner solution when your ESP supports it. DKIM signatures survive forwarding in a way that SPF-based solutions do not, and a properly delegated DKIM signature is unambiguous evidence that the message was authorized by your domain.

Use SPF as a fallback when DKIM delegation is not available, and understand that SPF has harder limits on how many vendors you can include before you hit DNS lookup problems.

If your ESP does not support either option, you have two remaining paths:

• Route ESP email through a subdomain (e.g., marketing.yourdomain.com) that has its own looser DMARC policy while your root domain uses p=reject.


• Move that sending function to a provider that does support proper alignment.

Verifying the fix before tightening DMARC

Before moving from p=none to p=quarantine or p=reject, verify that your ESP sending is actually passing DMARC. Check your aggregate reports for at least two full sending cycles (typically two weeks minimum) to account for batch sending schedules.

Look for:

• 0 DKIM alignment failures for your ESP source IPs


• SPF alignment passing if you are relying on SPF


• No unexpected IPs appearing in the reports

If you see failures that do not correspond to your known ESP activity, investigate before hardening your policy.

How DMARCFlow helps

DMARCFlow parses your aggregate reports automatically and surfaces alignment failures in a dashboard. Rather than manually reviewing XML reports, you see which sending sources are failing alignment and when they started failing.

This matters most when you have multiple ESPs, multiple brands, or a mixed setup with both marketing and transactional sending. A new alignment failure from a source you did not authorize is often the first sign of spoofing or an unauthorized sender.

DMARCFlow also alerts you when a known ESP starts failing alignment after a configuration change, which is a common cause of sudden deliverability drops.

If you are managing DMARC manually today, moving to a structured monitoring setup like DMARCFlow is the practical next step. You fix the ESP configuration once, and then you need a system that confirms the fix is holding and alerts you when it is not.

---

FAQ

Why does DMARC fail even though the ESP says DKIM is configured?

The ESP DKIM is configured correctly for their domain. The alignment failure happens because the DKIM signature is from the ESP domain, not yours. DMARC requires the signing domain to match the From domain. Having DKIM pass on the wrong domain does not satisfy DMARC alignment.

What is DKIM delegation?

DKIM delegation means installing a DKIM private key on the ESP server so the ESP can sign email with your domain instead of its own. The ESP then produces a DKIM signature with d=yourdomain.com, which passes DMARC alignment. It requires ESP support and DNS configuration on your end.

Can I use SPF instead of DKIM for third-party sending?

Yes, if the ESP sets the envelope sender (Return-Path) to your domain. This makes SPF alignment pass. However, SPF has a 10-lookup DNS limit, and SPF signatures do not survive email forwarding the way DKIM signatures do.

How do I check if my ESP is failing DMARC alignment?

Set up an RUA aggregate report destination in your DMARC record and review the reports for entries where DKIM or SPF shows pass but alignment shows fail. DMARCFlow automates this review and alerts you to alignment failures without manual XML parsing.

Should I move to p=reject if my ESP does not support DKIM delegation?

Do not move to p=reject until your ESP sending is passing DMARC alignment. Moving to p=reject prematurely will cause legitimate ESP email to be rejected. Use p=none first to collect reports and confirm the fix is holding.

---

Summary

Third-party ESP DKIM alignment failures are common and fixable. The root cause is a domain mismatch: the ESP signs with its own key, not yours, so DMARC alignment fails even though DKIM technically passes. The cleanest fix is DKIM delegation if your ESP supports it. The SPF fallback works if the ESP sets your domain as the envelope sender. Always verify alignment from aggregate reports before tightening your DMARC policy. And use a monitoring tool that can alert you when alignment breaks, because it will break again if you are not watching.