Blog · Dmarc
Why DMARC Alignment Fails When SPF and DKIM Both Pass
The Question
You have SPF and DKIM configured. Both checks pass when you test them. But your DMARC reports show failures. Or worse, legitimate email is being rejected.
This is one of the most common sources of confusion in email authentication. The reason it happens is that SPF and DKIM are doing one thing, and DMARC alignment is checking something else entirely.
Authentication vs. Alignment: The Fundamental Distinction
SPF and DKIM are authentication mechanisms. They answer the question: is this email actually coming from where it claims to be sending from?
SPF checks whether the mail server IP that delivered the message is authorized to send for the domain in the MAIL FROM (envelope sender).
DKIM checks whether the message was signed with a private key that corresponds to a public key published in DNS for the signing domain.
DMARC does not run its own authentication check. It asks: did the authenticated domain (from SPF or DKIM) match the domain the recipient sees in the From header?
The From header is the sender name your users see in their email client. It is the only domain DMARC alignment checks against.
This means it is entirely possible for both SPF and DKIM to pass while DMARC alignment fails. Authentication passed. Alignment did not.
How DMARC Alignment Works
When a receiving mail server evaluates a message against DMARC, it runs SPF and DKIM first. Then it compares the authenticated domain against the From header domain.
For SPF, there are two alignment modes:
Relaxed mode (adkim=r): The organizational domain must match. Subdomains are acceptable. So example.com aligns with newsletter.example.com.
Strict mode (adkim=s): The domains must match exactly. newsletter.example.com does not align with example.com.
The same applies to DKIM alignment with the aspf tag.
Most organizations use relaxed mode by default. Even so, alignment can still fail in common real-world sending scenarios.
Why Alignment Fails in Practice
Here are the three situations where I see alignment failures most often, even when SPF and DKIM both check out.
Scenario 1: Subdomain mailings
Your marketing team sends from a subdomain like newsletter.example.com. Your SPF record covers the IP addresses sending that mail. Your DKIM key is signed under example.com.
SPF passes (the server IP is authorized). DKIM passes (the signature is from example.com).
But the From header shows newsletter.example.com. Under strict alignment, example.com and newsletter.example.com do not match. Under relaxed alignment they do, so strict mode is where this fails.
If your DMARC policy is set to aspf=s (strict SPF alignment), your newsletter fails DMARC even though both authentication checks passed.
Scenario 2: Third-party bulk email senders
You use a marketing platform or email service provider to send on your behalf. The provider sends from their own infrastructure, using their own servers and their own DKIM key.
SPF passes because your SPF record includes the provider's server IPs. DKIM passes because the provider signs with a key under their own domain (say, provider.com), which your SPF include has authorized.
But the From header shows your domain. And the DKIM signature is from provider.com. When DMARC checks alignment, it compares the From header domain against the DKIM signing domain. They do not match, so DKIM alignment fails.
The fix is to use a provider that lets you add your own DKIM key under your domain. That way the DKIM signing domain matches your From header and alignment passes automatically.
If your provider only signs with their own domain, you can try authorizing that domain in your DMARC record with the dkim tag, though support for this varies by receiver. A more reliable fix is switching to a provider that supports custom DKIM signing.
This is the scenario I see causing the most real-world DMARC failures. Most organizations do not realize their bulk email platform is signing with a different domain until they read their aggregate reports.
Scenario 3: Multi-brand organizations with shared infrastructure
You run email for multiple brands from a single mail server or Microsoft 365 tenant. Each brand has its own From domain.
SPF passes (the shared server IP is authorized). But the From header varies by brand, and the envelope sender domain used for SPF may be a different domain entirely (often a bounces or relay address).
If the envelope sender domain does not match the From header domain, alignment depends on your aspf setting. In strict mode, this fails immediately. In relaxed mode it may pass if both domains share the same organizational domain, but multi-brand setups often span different organizational domains entirely.
How to Diagnose Alignment Failures in Your DMARC Reports
DMARC aggregate reports (sent to your rua address) tell you exactly which sources are failing alignment and why. They arrive as gzipped XML files.
For each failed message, the report tells you:
aspfsetting.adkimsetting.
If either
Manual XML parsing is tedious and slow. Most teams I have worked with only started understanding their alignment failures when they started looking at aggregate reports consistently. The problem is that most aggregate reports arrive from dozens of receivers, in different formats, and at unpredictable times. A tool like DMARCFlow that automatically parses and normalizes reports from all receivers, highlights alignment failures by source, and shows you the specific domains causing each failure makes this practical to do regularly rather than occasionally.
How to Fix Each Alignment Failure Scenario
Fixing subdomain alignment:
If you are using strict alignment (aspf=s or adkim=s) and sending from subdomains, consider switching to relaxed alignment while you audit your sending sources:
v=DMARC1; p=none; adkim=r; aspf=r; rua=mailto:dmarc-reports@example.com;
Relaxed alignment still validates organizational domain ownership while allowing subdomain variation. Start with p=none while you monitor, then move to quarantine or reject once you have fixed your alignment issues.
If you must use strict mode, every sending source must use the same domain in its From header as your primary organizational domain. This often requires changing how your email platform sets the From address.
Fixing third-party sender alignment:
For third-party senders, the cleanest fix is custom DKIM signing. Configure your provider to sign with a DKIM key under your domain instead of theirs. When the DKIM signing domain matches your From header domain, alignment passes automatically.
If your provider does not support custom DKIM signing, you have two options. First, check whether their domain can be added to your DMARC record via the dkim tag. Second, ensure your aspf setting is relaxed (not strict) to give SPF alignment the best chance of passing.
Many providers now support custom DKIM specifically to solve this alignment problem. If yours does not, that is a reasonable signal to reconsider the provider.
Fixing multi-brand shared infrastructure:
For organizations sending from multiple brands on shared infrastructure, each brand needs its own sending domain that matches its From header. This may mean using brand-specific subdomains for the MAIL FROM and DKIM signing domains, or it may mean separating sending infrastructure entirely per brand.
ARC (Authenticated Received Chain) can also help in complex routing scenarios where intermediate services modify messages. ARC preserves original authentication results through a chain of intermediaries, helping messages that would otherwise fail DMARC at the final destination due to forwarding or list serving. If your brand infrastructure involves legitimate intermediate processing, ARC can prevent those messages from being rejected.
FAQ
Can alignment fail even with strict mode and SPF passing?
Yes. If the MAIL FROM domain (envelope sender) differs from the From header domain, strict SPF alignment fails. This is common with bulk email platforms that use their own envelope sender domain for bounce handling. The SPF check passes because the server IP is authorized. The alignment check fails because the envelope domain and From header domain do not match.
Does ARC help with alignment failures?
ARC does not fix alignment failures directly. It preserves original authentication results when a message passes through intermediate servers that modify headers or content. If your own sending infrastructure causes alignment failures, ARC does not resolve those. ARC helps when forwarding or mailing list services are the source of the problem.
Should I use relaxed or strict alignment?
Most organizations should start with relaxed alignment. Strict alignment is appropriate only when you have full control over every sending source and can guarantee that all envelope sender and DKIM signing domains match your From header exactly. Many organizations discover, when they switch to strict mode, that they have more sending sources than they realized.
Why does Gmail accept mail that Microsoft 365 rejects?
Different receivers apply DMARC differently. Some receivers are more permissive with alignment failures for known sending sources. Microsoft 365 tends to apply DMARC strictly, which means alignment failures that Gmail overlooks will cause rejections in Exchange Online. This is one reason aggregate reports from multiple receivers are valuable and why you should test against your most important recipients, not just a single provider.
Summary
The core confusion around DMARC alignment failures comes from treating authentication and alignment as the same thing. They are not.
SPF and DKIM check whether the sending infrastructure is authorized. DMARC alignment checks whether the domain that authorized the message matches the domain your recipients see in their email client.
When these two things do not match, authentication passes but alignment fails. The fix is either to make the domains match (by controlling your sending infrastructure and third-party providers) or by using relaxed alignment mode while you work toward a cleaner setup.
The only way to know which of your sending sources are causing alignment failures is to read your aggregate reports consistently. Most teams discover they have more alignment failures than they expected once they start looking.