Why DMARC Fails When SPF and DKIM Both Pass: Alignment Explained

The Confusion

You check your email headers. SPF says PASS. DKIM says PASS. Then DMARC fails and you assume something is broken.

It is not broken. It is working as designed. You are running into one of the most common misconceptions in email authentication: confusing authentication with alignment.

SPF and DKIM check whether a mail server is authorized to send. DMARC checks whether the domains used in those checks match the From header domain your recipients see. These are separate requirements, and both must pass for DMARC to pass.

Authentication vs. Alignment

Think of it this way.

Authentication asks: "Is this sender allowed to send mail from this mail server?" SPF and DKIM answer that question. They check whether the sending infrastructure is authorized.

Alignment asks: "Does the domain that sent this mail match the domain that appears in the From header?" DMARC answers that question. It checks whether the authenticated domain and the visible sender domain are the same.

You can pass authentication and fail alignment. When that happens, DMARC fails even though your SPF and DKIM records are correct.

How DMARC Alignment Works

When a mail server receives a message, it runs SPF and DKIM checks against specific domains.

SPF verifies the domain in the SMTP MAIL FROM command. That domain is often a subdomain like mta57.example.com even if your From address shows support@example.com.

DKIM signs a domain your mail provider controls. The signing domain is listed in the DKIM signature header and might be something like k1._domainkey.example.com or a different domain entirely like d.marketing.example.com.

DMARC then compares those authenticated domains against your From header domain: example.com.

If the From header shows support@example.com but your SPF ran against mta57.example.com and your DKIM used d.marketing.example.com, neither of those matches example.com. DMARC alignment fails. Your mail fails DMARC even though SPF and DKIM both passed.

This is why forwarded mail fails DMARC. When someone forwards your message, their mail server becomes the SPF pass. The From header still shows your domain, but the SMTP conversation is from their server. SPF authenticates their server, not your domain. Alignment fails because the authenticated domain does not match your From header.

ADKIM and ASPF: Strict vs. Relaxed Alignment

DMARC has two tags that control how strictly alignment is enforced: adkim and aspf.

Relaxed alignment (the default, aspf=r and adkim=r) allows subdomains to match. If your SPF check returns mta57.example.com and your From header is support@example.com, relaxed alignment considers them aligned because both are under example.com.

Strict alignment (aspf=s or adkim=s) requires exact domain matches. The domain in your From header must be byte-for-byte identical to the domain that passed SPF or DKIM. This catches more failures but requires precise control over all your sending systems.

Most organizations use relaxed alignment because it accommodates common email infrastructure. You switch to strict alignment when you want a tighter posture and have audited every system that sends mail from your domain.

Common Scenarios That Cause Alignment Failures

Third-party mailers: You send marketing email through SendGrid or Mailchimp. Your SPF covers your own mail server. Your DKIM signature comes from the provider's domain. But your From header still shows your domain. The authenticated domains and the From domain do not match. This fails alignment unless your provider supports custom DKIM signing on your domain.

Shared SMTP infrastructure: Your SaaS tools send through shared IP ranges. Your SPF record covers your own server. The SaaS tool sends from its own servers, which SPF authenticates under a different domain. The From domain does not align with the authenticated domain.

Office 365 and hybrid setups: In hybrid Exchange environments, internal relay servers may use different namespaces. SPF passes for the relay server domain, but the From header shows the user domain. Alignment fails if those namespaces do not match.

Forwarded messages: When a recipient forwards your message, the forwarded-to server receives the message from the original recipient's mail server. SPF authenticates the original recipient's server. The From header still shows your domain. Alignment fails because the authenticated domain does not match.

How to Diagnose Alignment Issues

The fastest way to diagnose alignment is to check the authserv-id results in your email headers.

Authentication results usually look like this:

• header.from=support@example.com
• dkim=pass header.d=marketing.example.com
• spf=pass mail.from=mta57.example.com

Here, both DKIM and SPF pass authentication. But marketing.example.com does not match support@example.com, and mta57.example.com does not match support@example.com. Alignment fails for both mechanisms. DMARC fails.

If you manage multiple sending sources and domains, manually checking headers is not practical. This is where DMARC aggregate reports become essential. They show you alignment failures across every sending source in one view. Tools like DMARCFlow parse these reports and tell you exactly which domains are failing, which DKIM selectors are misconfigured, and which third-party senders are causing problems. You fix what you can see.

How to Fix Alignment

For DKIM alignment failures, the fix depends on how your DKIM is configured.

If a third-party sender signs with its own domain, ask them about custom DKIM signing. Many providers let you add your own DKIM record so the signature uses your domain instead of theirs. This makes DKIM alignment pass automatically.

If your own mail server is signing DKIM with the wrong subdomain, update your DKIM selector to use your root domain. The selector record in DNS should publish the key under selector._domainkey.yourdomain.com.

For SPF alignment, the issue is usually the MAIL FROM domain. If you use a third-party bulk mailer, they may use their own bounce domain instead of yours. Some providers support custom MAIL FROM domains so the SMTP conversation uses your domain. Others do not.

If forwarded mail is causing alignment failures, the fix is not in your DNS records. The recipient's mail provider would need to apply ARC (Authenticated Received Chain) to preserve your authentication results through the forwarding chain.

FAQ

What is DMARC alignment?
DMARC alignment is the requirement that the domain authenticated by SPF or DKIM must match the domain in the From header. A mail can pass SPF or DKIM authentication but still fail DMARC if the domains do not align.

Can SPF pass but alignment still fail?
Yes. SPF can pass because the sending mail server is authorized for the MAIL FROM domain. But if that MAIL FROM domain does not match your From header domain, SPF alignment fails under a strict aspf=s policy, and under relaxed alignment it also fails if the MAIL FROM domain is a sibling subdomain that does not share the same root.

Can DKIM pass but alignment still fail?
Yes. This is the most common alignment failure. Your DKIM signature is valid because the message was signed by an authorized mail server. But if the signing domain does not match your From header domain, DKIM alignment fails. This happens routinely with third-party senders who sign with their own domains.

Does relaxed alignment solve subdomain problems?
It helps, but it does not solve everything. Relaxed alignment treats subdomains as aligned with their root domain. So support.example.com aligns with example.com. But if your DKIM signature shows marketing.example.com and your From header shows sales.example.com, those are different subdomains and relaxed alignment does not make them align. They only align if they share the exact same second-level domain.

How do third-party senders affect alignment?
Third-party senders introduce alignment failures by default because they sign with their own domains, not yours. Most DMARC failures from marketing email, transactional email platforms, and SaaS notification tools trace back to this problem. The solution is custom DKIM signing or MAIL FROM domain configuration where the provider supports it.

How does DMARCFlow help with alignment failures?
DMARCFlow parses aggregate DMARC reports and surfaces alignment failures across all your domains and sending sources. Instead of manually reviewing headers or trying to trace which sending system caused a failure, you get a structured view of which specific domains and selectors are misaligned. That makes it practical to fix third-party senders systematically rather than discovering alignment failures when mail stops arriving.

The Short Version

SPF and DKIM check authentication. DMARC checks alignment. They are different jobs.

Your mail passes SPF and DKIM when the sending infrastructure is authorized. Your mail passes DMARC when the domains used in those checks also match the From header domain your recipients see.

When alignment fails, the fix is usually one of these:

• Configure your mail systems to use your own domain in SPF and DKIM signatures


• Use relaxed alignment if strict alignment is too restrictive for your current infrastructure


• Set up custom DKIM or MAIL FROM domains with third-party senders who support it


• Accept that forwarded mail will fail DMARC unless the forwarding provider applies ARC

Alignment is the part most people skip when they first set up DMARC. Getting it right is what separates domains that pass DMARC from domains that fail it even with perfectly configured SPF and DKIM records.