Why DMARC Fails Even When SPF and DKIM Both Pass

The Question That Confuses Everyone

You have configured SPF. It passes. You have configured DKIM. It passes. Then your DMARC report shows a failure and you spend the next hour trying to figure out what went wrong. You check your DNS records - everything looks correct. You run a check tool - SPF passes, DKIM passes. Yet DMARC fails. Nothing went wrong with your SPF or DKIM setup. The problem is that DMARC requires something neither of those mechanisms check: domain alignment. Authentication and alignment are two different things. SPF and DKIM prove that a message came from a server that is authorized to send for a domain. DMARC proves that the domain in the From: header actually matches the domain that was authenticated. That second part is called alignment, and it trips up almost everyone the first time they see it.

Authentication vs Alignment

Here is the distinction in plain terms. SPF and DKIM are authentication mechanisms. They answer the question: "Is this server allowed to send mail for this domain?" DMARC alignment is a policy layer. It answers a different question: "Is the domain that was authenticated the same domain that appears in the From: header?" A message can pass SPF and DKIM but still fail DMARC if the authenticated domain does not match the From: domain. This is not a bug. This is the intended behavior - and it is the feature that makes DMARC useful for preventing spoofing.

How SPF Alignment Works

SPF verifies that the IP address sending the mail is authorized for the domain in the MAIL FROM command (also called the envelope-from or return-path domain). For DMARC alignment, the MAIL FROM domain must match the From: domain - either exactly (strict mode) or at the organizational level (relaxed mode, the default). Relaxed mode: example.com and mail.example.com are considered aligned because they share the same organizational domain.
Strict mode: only example.com matches example.com. The domains must be identical. Most organizations use relaxed mode because it is more forgiving of legitimate mail flows. But that forgiveness does not extend to third-party senders. Example: you send a newsletter through Brevo. Brevo's servers send the mail with MAIL FROM=b2cl.bnc1.braze.com. SPF on Brevo's servers passes because Brevo is authorized to send for bnc1.braze.com. But your From: header says you@example.com. The MAIL FROM domain (bnc1.braze.com) does not align with your From: domain (example.com). DMARC fails - even though SPF passed.

How DKIM Alignment Works

DKIM attaches a cryptographic signature to the message. The signature includes a domain in the d= field. That domain is the one DKIM is vouching for. For DMARC alignment, the d= domain must align with the From: domain - again, either exactly (strict mode) or at the organizational level (relaxed mode). Example: you send transactional email through SendGrid. SendGrid signs the message with d=sendgrid.net. Your From: header says you@example.com. The d= domain (sendgrid.net) does not align with your From: domain (example.com). DMARC fails - even though DKIM passed. This is the scenario that confuses people most. Both mechanisms individually work correctly. The alignment requirement is what causes the failure.

The Four Outcomes of SPF, DKIM, and DMARC

Understanding all nine combinations helps you read DMARC reports correctly.

SPF	DKIM	DMARC	What it means
Pass	Pass	Pass	Message authenticated and aligned. Legitimate.
Pass	Fail	Fail	SPF aligned, DKIM not aligned. Message fails DMARC.
Fail	Pass	Fail	DKIM aligned, SPF not aligned. Message fails DMARC.
Fail	Fail	Fail	Neither aligned. Fails DMARC.
Pass	Pass	Fail	Both mechanisms authenticated but neither achieved alignment with the From: domain. Usually a third-party sender using its own domain for MAIL FROM and DKIM signing simultaneously.
Pass	Pass	Pass	Full alignment. The goal state.

The row labeled "pass/pass/fail" is the scenario this article is about. It is common, it is confusing, and it is almost always caused by a third-party email sender that has not been set up to send on your behalf.

Why Third-Party Senders Break Alignment

Third-party senders are the primary cause of alignment failures. When you hand your mail to SendGrid, Brevo, Mailchimp, or any other ESP, those servers send mail that SPF and DKIM can verify - but they send it using their own domains in the MAIL FROM and DKIM d= fields, not yours. There are two ways to fix this: Option 1: Use the ESP's custom domain sending feature.
Most reputable ESPs let you authenticate with your own domain. Instead of sending from sendgrid.net, you configure them to sign DKIM with your domain and send from your own mail servers or subdomains. This keeps alignment intact. It usually requires adding DKIM records to your DNS and sometimes SPF includes or redirect mechanisms. Option 2: Configure SPF to include the ESP and use DKIM signing on your domain.
Add the ESP's include mechanism to your SPF record so your domain is the MAIL FROM domain. Then configure the ESP to sign DKIM with your domain (d=yourdomain.com). Both authentication and alignment will then pass. Not all ESPs support custom DKIM signing. If yours does not, you are limited to Option 1 only.

How to Diagnose Alignment Failures

Open your DMARC aggregate report. Look for source IPs where:

SPF result = pass
DKIM result = pass
DMARC result = fail

This specific combination is an alignment failure. The sending server is authenticated but not aligned with your From: domain. DMARCFlow surfaces this pattern directly. When you receive a DMARC report, the aggregate data shows each source IP's SPF, DKIM, and DMARC results. A spike in pass/pass/fail - both authentication methods succeed but neither aligns - tells you a third-party sender needs configuration attention before you move to p=reject. If you do not have a DMARC report parser, here is the manual approach: check which ESP or marketing platform sent the mail, then look at the DKIM signature's d= domain. If it does not match your From: domain, alignment has failed.

How to Fix Alignment Failures

Fix each sender systematically. For marketing email (Mailchimp, Brevo, etc.):
Ensure the ESP supports custom DKIM domain signing. Add the required DKIM records to your DNS. Verify the DKIM signature uses your domain before sending at scale. For transactional email (SendGrid, Postmark, etc.):
Many support custom DKIM signing. Check the ESP's documentation for "custom domain authentication" or "whitelabeling." Add the DKIM record, then verify with the ESP's authentication check tool before switching from their default signing. For forwarded mail:
Forwarded messages often break SPF alignment because the forwarder's server becomes the new sender. DKIM usually survives forwarding unless the forwarder modifies the message body. This is why ARC (Authenticated Received Chain) exists - it lets intermediate servers preserve authentication results through a forwarding chain. If you manage a mailing list and see alignment failures, the list software's behavior is the culprit. Some mailing lists can be configured to preserve the original MAIL FROM or to add an ARC header. Most cannot by default. When you are unsure which sender is causing failures:
Look at the source IP in the DMARC report and reverse-DNS it. That often reveals the ESP or hosting provider. Then check their documentation for how to configure aligned sending.

FAQ

Why does DMARC fail when SPF and DKIM both pass?
Because DMARC requires domain alignment in addition to authentication. The MAIL FROM domain (for SPF) and the DKIM signing domain (d=) must match the From: domain. If they do not, DMARC fails even when both SPF and DKIM individually pass. This is the most common source of confusion with DMARC reports. What is DMARC alignment?
DMARC alignment means the domain used in SPF (MAIL FROM) or DKIM (d= domain) must be the same as - or a registered subdomain of - the From: domain. This prevents attackers from sending mail that passes authentication but spoofs the From: header. Relaxed mode (the default) allows subdomains. Strict mode requires an exact domain match. How do I check if my domain has alignment issues?
Look at your DMARC aggregate reports. If you see "pass" for SPF or DKIM but "fail" for DMARC, you have an alignment problem. DMARCFlow automates this by alerting you specifically when alignment failures appear, so you can catch third-party sender misconfigurations before they affect deliverability or before you move to a stricter DMARC policy. Does ARC fix forwarded mail alignment?
ARC (Authenticated Received Chain) preserves authentication results through a forwarding chain by adding an ARC header at each hop. It does not fix the underlying alignment problem but it gives receiving servers more context about where a message originated. Some forwarding services and mailing list software now add ARC headers. It is not universally supported and should not be relied upon as the primary fix for forwarding-related alignment failures.