Why Your DMARC Monitoring Missed a Failure Even Though SPF and DKIM Passed

A practitioner who writes DMARC guides for a living recently discovered their own monitoring tool had missed a failure on their own domain. The domain was not aligned. The monitoring dashboard showed green. No alert fired.

This is not a beginner mistake. It is a structural gap in how most DMARC monitoring works.

The distinction that matters is this: your monitoring might be checking whether individual authentication mechanisms pass, without checking whether those passes actually satisfy DMARC alignment rules. Those are different things. You can have SPF pass, DKIM pass, and still fail DMARC because the authenticated domain does not align with the From header domain.

Authentication Pass Is Not the Same as DMARC Pass

DMARC requires at least one aligned authentication pass. That means one of two things must be true:

• SPF aligned pass: The domain in the SMTP envelope MAIL FROM (the return-path) is aligned with the From header domain under relaxed alignment rules.
• DKIM aligned pass: The domain in the DKIM signature (the d= tag) is aligned with the From header domain.

Alignment under relaxed rules (aspf=r, the default) means the organizational domains match, even if the exact subdomains differ. If your From header is user@example.com and your return-path is noreply@mail.example.com, those are both example.com at the organizational level, so SPF alignment can pass.

The trap is that most monitoring tools show you the raw SPF result and the raw DKIM result separately, without ever checking whether either result produced an aligned pass. You see SPF: pass. You see DKIM: pass. You assume DMARC passes. That assumption is wrong any time neither pass was aligned with the From domain.

Three Scenarios Where Individual Auth Passes But DMARC Fails

Scenario 1: A subdomain sends mail with no SPF record.

Your apex domain has SPF and DKIM configured. A subdomain like newsletter.example.com starts sending marketing mail. The subdomain has no SPF record. Receiving servers check SPF for newsletter.example.com, find nothing, return "none". That is not a fail -- it is a none result, which most monitoring systems do not flag as problematic. But under DMARC alignment rules, a "none" result from SPF does not produce an aligned pass. DMARC fails. The message is rejected at p=reject or quarantined at p=quarantine, silently.

Scenario 2: The MAIL FROM domain and the From header have different organizational domains.

This happens with some third-party email platforms and legacy forwarding setups. The return-path is set to a domain controlled by the sending platform, not your domain. SPF checks out for that platform domain. DKIM might also sign with the platform domain. But neither authenticated domain matches your From header domain, so alignment fails. DMARC fails. The monitoring dashboard shows SPF pass, DKIM pass, because it is looking at the wrong domains.

Scenario 3: DKIM signs with the right domain but a selector mismatch produces a "temperror".

A temporary DNS failure during DKIM verification returns "temperror" rather than pass or fail. Under RFC 8372, temperror does not produce a DMARC pass -- the aligned result is treated as fail, not pass. Some monitoring tools log this as a DKIM anomaly but do not propagate it into the DMARC disposition calculation, so you see DKIM: temperror in one view and assume the overall status is fine.

What Most DMARC Monitoring Actually Checks

Most DMARC monitoring dashboards are built around a simple model: count SPF passes, count DKIM passes, count DMARC passes, show a pie chart. That model is useful for spotting sudden changes in aggregate auth rates, but it is blind to alignment failures that occur within passing auth results.

The gap is structural. Raw SPF pass means the sender IP was authorized for the domain in the MAIL FROM. It says nothing about whether that MAIL FROM domain has any relationship to your From header domain. Raw DKIM pass means a valid cryptographic signature was found for the domain in the d= tag. It says nothing about whether that d= domain is the same organizational domain as your From header.

Alignment is the layer that connects the authenticated identity to the visible sender identity. It is the step that most monitoring tools skip.

The Self-Audit: Is Your Monitoring Checking Alignment?

Run this check against your own DMARC aggregate reports.

Open your RUA report for a single sending domain. Find a message where SPF showed pass or DKIM showed pass. Then ask:

• What is the organizational domain of the MAIL FROM (return-path) address?
• What is the organizational domain of the From header?
• Do those two organizational domains match under relaxed alignment rules?

If you cannot answer those three questions from your current monitoring dashboard, your monitoring is not checking alignment. You are watching the wrong metric.

A second check: look for any sending domain in your reports where the disposition is "fail" but the individual SPF and DKIM results both show something other than "none" or "fail". That combination -- auth mechanisms not failing, but overall DMARC failing -- is the signature of an alignment failure. It is the incident class that most monitoring misses.

What Good Monitoring Alerts On

Alignment-aware monitoring surfaces three things that raw auth monitoring misses:

New sending domains appearing in reports. A new return-path domain with a high failure rate is often the first signal of a subdomain sending mail without proper configuration. This is not visible in aggregate pass rates -- it requires looking at per-domain breakdown.

Sudden disposition changes on known sending domains. If a vendor or internal system goes from 100% pass to 100% reject over 24 hours, that is a mailflow incident. Most dashboards do not alert on disposition change -- only on absolute failure counts.

Alignment failure rates separate from auth failure rates. A monitoring system that shows alignment pass rate alongside auth pass rate gives you a much more accurate picture of actual DMARC health. A domain can have 100% SPF pass and 0% aligned SPF pass simultaneously.

This is the monitoring gap the expert hit. Their dashboard was showing auth pass rates because that is what their tool measured. It was not measuring alignment -- and that is the metric that determines whether DMARC actually passes.

What DMARCFlow Actually Monitors (and What Most Tools Skip)

Most DMARC monitoring tools show you the pass/fail counts for SPF and DKIM separately. DMARCFlow adds the alignment layer on top, because alignment is what DMARC actually checks at enforcement time.

The practical difference: in DMARCFlow, you see aligned SPF pass rate and aligned DKIM pass rate as distinct metrics from raw SPF and DKIM pass rates. If your domain has 100% raw SPF pass but 40% aligned SPF pass, DMARCFlow shows you both numbers. A basic dashboard shows you only the 100% and calls it good.

That gap -- the difference between raw auth pass and aligned pass -- is where the expert's failure lived undetected. It is the most common class of silent DMARC failure, and it is invisible without alignment-aware reporting.

DMARCFlow also flags new sending domains automatically with their failure rates, so a subdomain misconfiguration surfaces as an alert rather than sitting undetected in a report you have to manually review. That is the specific detection capability that would have caught the expert's incident within hours instead of days.

How to Find Alignment Failures in Your Aggregate Reports

The data is in your DMARC reports. Here is what to look for.

In a standard RUA aggregate report, each block contains a element with the disposition (pass, fail, quarantine, reject) and a element with SPF and DKIM results. The key is cross-referencing the return-path domain in against the From domain in the element.

If the organizational domains differ and aspf=r (relaxed alignment), alignment fails even when SPF or DKIM individually pass.

For DKIM, check the value in . If that domain does not share an organizational domain with the , the DKIM pass is not an aligned pass.

This analysis is tedious to do by hand across thousands of records. It is practical at scale only with aggregate report tooling that computes alignment automatically.

Where DMARCFlow Fits in the Monitoring Stack

The monitoring gap this post describes -- raw auth pass vs. aligned pass -- is not a theoretical problem. It is the specific gap that caused the expert's failure to go undetected. The only practical way to close it is to monitor alignment specifically, not just individual auth mechanisms.

That is what DMARCFlow was built to do. It surfaces the difference between raw auth pass and aligned pass in aggregate reports, so you see the actual DMARC pass rate rather than a misleading proxy. And it alerts on new sending domains automatically, which is the fastest way to catch subdomain misconfigurations before they cause mail outages.

If you are currently monitoring DMARC with a tool that only shows raw SPF and DKIM pass rates, you have the same gap the expert had. The fix is not to check more often -- it is to check the right metric.

The Checklist Before You Trust Your Dashboard

Before you assume your monitoring is working, run through this:

1. Identify every return-path domain that appears in your RUA reports. If you do not recognize one, that is a problem to investigate.

2. For each return-path domain, confirm it is intentionally authorized to send on behalf of your From domain.

3. Check whether your monitoring surfaces aligned pass rates, not just raw auth pass rates.

4. Look for any record where disposition is reject or quarantine but both SPF and DKIM show non-fail results. That is an alignment failure.

5. If you find alignment failures, determine whether the sending domain is authorized. If it is not, the fix is in your SPF records or your sending infrastructure configuration. If it is, your monitoring gap is what allowed it to go undetected.

Your monitoring might be showing you green because it is looking at the wrong metric. That does not mean monitoring is useless. It means the metric needs to change.

FAQ

Why does DMARC fail even when SPF and DKIM both pass?

DMARC requires at least one aligned authentication pass. Alignment means the domain that passed authentication must share an organizational domain with the From header. If SPF passes for a MAIL FROM domain that is a different organizational domain from your From header, that SPF pass is not an aligned pass. The same applies to DKIM. Individual mechanism passes do not automatically satisfy the alignment requirement.

What is the difference between authentication pass and alignment pass in DMARC?

Authentication pass means a specific mechanism (SPF or DKIM) validated successfully against a specific domain. Alignment pass means the domain that passed authentication is the same organizational domain as the From header, or a subdomain of it under relaxed alignment rules. A message can have SPF pass and DKIM pass but still fail DMARC if neither pass was aligned with the From domain.

How do I check if my DMARC monitoring is catching alignment failures?

Look for a metric in your monitoring that shows aligned pass rate separately from raw auth pass rate. If you can only see raw SPF pass rate and raw DKIM pass rate, your monitoring is not checking alignment. Cross-reference your RUA reports manually for a sample period: find records where disposition is fail but individual SPF and DKIM results are non-fail. If you find any, your monitoring has an alignment gap.