Why Email Routing Fails When SPF Passes: The DMARC Alignment Problem

Why Email Routing Fails When SPF Passes

A common support ticket goes something like this: email to a specific external domain is not arriving, but the SPF check is showing pass. Everything looks correct on the surface. The email still does not get through.

This confusion comes up often enough that it deserves a clear explanation. The short version is this: SPF passing does not guarantee email delivery. SPF verifies that the sending server is authorized to send for your domain. It does not verify that the From address domain aligns with that server, that the email was signed by your infrastructure, or that the receiving system considers the message legitimate.

When SPF passes but email fails, the missing piece is almost always DKIM, DMARC alignment, or both.

SPF, DKIM, and DMARC: What Each Actually Checks

Email authentication has three main layers. They are often explained together but they check different things.

SPF (Sender Policy Framework) checks whether the IP address of the server sending the email is authorized to send for the domain in the SMTP envelope. It does not check the From address that users see. It does not verify the email was not altered in transit. It only confirms that a server that is allowed to send for your domain is sending this particular message.

DKIM (DomainKeys Identified Mail) adds a cryptographic signature to the email header. The sending mail server signs the message using a private key. Receivers look up the corresponding public key in DNS under the selector domain (e.g., selector._domainkey.example.com). If the signature verifies, the email was not modified between signing and delivery. DKIM checks the content integrity and the signing domain.

DMARC alignment is the layer that ties SPF or DKIM to the From address domain. It asks: does the domain in the SPF or DKIM result match the domain the recipient sees in the From address? If they do not match, DMARC alignment fails, even if SPF and DKIM individually pass.

Full DMARC validation requires alignment on at least one of SPF or DKIM. You can pass SPF alignment, DKIM alignment, or both. You fail DMARC if neither SPF nor DKIM is aligned with the From domain.

The Specific Failure Mode: SPF Passes But Email Does Not Arrive

Here is what is happening in the scenario where SPF shows pass but email fails.

The sending organization's mail server is authorized via SPF. The receiving domain accepts the connection from an authorized server. But the email is not delivered or is flagged as suspicious.

This typically happens for one of three reasons.

DKIM is not signed. Many organizations send email from third-party platforms -- marketing tools, CRM systems, support platforms -- without configuring DKIM signing for their own domain. The third-party platform sends the email and SPF passes because the platform's IP is authorized for its own domain. But the From address is your domain, and DKIM is not signed for your domain. DMARC alignment fails because neither SPF nor DKIM is aligned with your From domain.

DKIM is signed by a different subdomain. Some platforms sign with a subdomain they control (e.g., sendgrid.com rather than yourdomain.com). SPF might pass at the platform level, DKIM might verify, but DMARC alignment fails because the signing domain does not match your From domain.

Forwarding broke DKIM. If the email passed through a forwarding chain, DKIM signatures are often stripped or invalidated because the forwarding server modifies headers or content. SPF alignment may also fail if the forwarder is not authorized for the original domain.

The key point: the failure is not visible in SPF monitoring alone. You only see it when you look at DMARC aggregate reports or when the receiving domain silently rejects the message.

How to Diagnose SPF-Pass Email Failures

When you encounter this scenario, here is a practical diagnostic path.

First, look up the DMARC policy for the destination domain. Use a DNS lookup for _dmarc.yourdomain.com from the sender side (or ask the recipient if possible). This tells you what policy the receiving domain is enforcing.

Second, check your own DMARC aggregate reports. If you have DMARC reporting enabled, the aggregate report from the destination domain will show alignment failures with a reason code. The most common reason codes are:

• fail -- alignment failed on both SPF and DKIM
• Temperror -- the receiver could not complete validation due to a temporary issue
• Permerror -- the receiver found a structural problem with your DMARC record

Third, verify DKIM signing. For each sending source, check whether DKIM is signed with your organizational domain. If you use a third-party platform, check whether they support custom DKIM keys that use your domain rather than theirs. Common examples: SendGrid, Mailgun, Salesforce, and Amazon SES all support custom DKIM.

Fourth, test directly. Send a test message from your infrastructure directly to an external address and check headers. Then send through the same path that failed and compare the authentication results in the headers. This isolates whether the problem is your infrastructure or the third-party platform.

How to Fix DMARC Alignment Failures

Once you have identified the source of the alignment failure, here is how to fix it.

For third-party senders that are not signing with your domain: configure custom DKIM. Most major email service providers have documentation for setting up custom DKIM keys tied to your domain. This means the DKIM signature uses your domain as the signing domain, which passes DMARC alignment.

For platforms that do not support custom DKIM: route their email through a relay that can apply your DKIM signature. Some organizations use a dedicated mail relay that sits between their internal systems and the outside world and adds DKIM signatures on behalf of sending sources that cannot do it themselves.

For forwarding issues: the fix depends on the forwarding path. If your email is being forwarded by a mailing list or a forwarding service, the forwarder needs to either preserve DKIM signatures (some do, many do not) or re-sign the message with its own DKIM key. If the forwarder cannot do either, you may need to route around that forwarding path.

Regardless of the root cause, move your DMARC policy through the progression stages. Start with p=none to collect reports and verify alignment. Move to p=quarantine to see how many legitimate messages fail alignment. Only move to p=reject once you have confirmed that all legitimate sending sources are aligned.

The Diagnostic Tool You Need When SPF Passes But Email Fails

Here is the practical problem: SPF-only monitoring tells you your sending server is authorized. It does not tell you whether DKIM is signed, whether the signing domain matches your From address, or whether alignment is passing or failing. When an email routing failure comes in as a ticket, SPF monitoring will show green. Your DMARC reports will show the real answer.

DMARCFlow monitors DMARC alignment results across all your sending sources. It surfaces alignment failures with the specific reason code, identifies which sending domain is causing the failure, and tracks whether your sending infrastructure is properly configured before you move to a stricter DMARC policy. When email fails for a specific domain despite SPF passing, the answer is in your DMARC aggregate reports. DMARCFlow makes those reports actionable without requiring you to parse raw XML.

FAQ

Can email pass SPF but still fail DMARC?
Yes. SPF passes when the sending server IP is authorized. DMARC alignment requires that the From domain matches the domain used in SPF or DKIM. If your From domain is example.com but the DKIM signature is from sendgrid.com, alignment fails even though SPF passed. This is one of the most common email authentication failures practitioners encounter.

Why does email to one specific domain fail when SPF passes?
The destination domain likely has a strict DMARC policy that rejects alignment failures. Your sending infrastructure is authorized via SPF, but if DKIM is not signed for your domain or the signing domain does not match your From address, the receiving server rejects or filters the message. The fix is usually on your side: configure DKIM signing for all sending sources, not just SPF.

What is DMARC alignment?
DMARC alignment means the domain in your From address matches the domain in your SPF result or your DKIM signature. DMARC passes when at least one of SPF or DKIM is aligned with the From domain. If neither is aligned, DMARC fails regardless of whether SPF and DKIM individually pass.

How do I check if my DKIM is working correctly?
Send a test message to a public inbox that shows authentication headers (such as a Gmail or Outlook address) and check the received headers for the Authentication-Results field. Look for dkim=pass and dmarc=pass. If you see dkim=fail or dmarc=fail, check whether your DKIM selector is published in DNS and whether the signing domain matches your From domain.