Why SPF and DKIM Pass But DMARC Alignment Still Fails

When SPF and DKIM both pass but DMARC fails, most people assume something is misconfigured. Usually the setup is correct. The actual problem is a separate requirement that SPF and DKIM do not enforce: alignment. This distinction trips up a lot of people who are otherwise careful with their email infrastructure. Here is what is actually going on, and how to fix it.

The difference between authentication and alignment

SPF and DKIM are authentication mechanisms. They answer the question: was this email sent by or on behalf of an authorized entity? SPF checks which server is allowed to send email for a domain. When SPF passes, it means the sending mail server's IP is listed in the domain's SPF record. It says nothing about the From address the recipient sees. DKIM checks whether an email was signed with a private key that matches a public key published in DNS. When DKIM passes, it means the signature is cryptographically valid. It says nothing about whether the From address matches the signing domain. DMARC does something SPF and DKIM do not: it checks alignment. Alignment means the domain in the visible From address must match the domain that passed SPF or the domain in the DKIM signature. Without alignment, DMARC fails even when both SPF and DKIM pass. This is by design. DMARC RFC 7489 defines alignment as the requirement that the domain used in the RFC 5322 From header matches the authenticated domain. The purpose is to prevent someone from sending email that appears to come from your domain but is actually authorized by a completely different domain.

What DMARC alignment actually means

DMARC has two alignment modes: relaxed and strict. Relaxed alignment allows subdomains. If your From address is newsletter@example.com and the authenticated domain is mail.example.com, relaxed alignment passes because the base domain matches. Strict alignment requires an exact match. newsletter@example.com must align with example.com and nothing else. In practice, most organizations use relaxed alignment because it accommodates legitimate email workflows where a subdomain is used for internal routing. Strict alignment is more secure but harder to implement without thorough audit of every sending system.

Real example: reading authentication results

Here is a realistic authentication result you might see:

Authentication-Results: mx.example.com;
  spf=pass (google.com: 209.85.220.41 is authorized);
  dkim=pass (google.com);
  dmarc=fail (alignment mismatch)

SPF passes. DKIM passes. But DMARC fails. Why? The From address is sender@example.com. The SPF result says the email was authorized by google.com. The DKIM signature is from google.com. Neither of those domains matches example.com. The From address claims to be from example.com but google.com is the authenticated sender. Without explicit authorization for google.com to send on behalf of example.com in the SPF record, DMARC alignment fails. This happens constantly with transactional email platforms, marketing tools, and internal mail systems that relay through external services.

The five most common causes of alignment failure

1. Marketing email platforms Services like Mailchimp, SendGrid, Constant Contact, and Klaviyo send email from their own domains. If you want the From address to show your domain, these services must send through your domain's mail infrastructure, not theirs. Many setups configure the From address to display your brand name while the actual envelope sender is the platform's domain. That is where alignment breaks. 2. CRM and sales engagement tools Salesforce, HubSpot, Outreach, and similar tools often inject email through their own sending infrastructure. The email appears to come from your domain but is actually sent from the vendor's mail servers under their own SPF and DKIM. This is one of the most common causes of DMARC alignment failures in mid-size organizations. 3. Email forwarding When an email is forwarded, the original SPF check may pass for the original recipient's server, but the forwarded message often ends up with a different envelope sender. The forwarding server rewrites the From or adds its own envelope sender, breaking alignment. 4. Multi-step notification systems Password reset emails, order confirmations, and alert systems often route through third-party platforms. If the notification is generated by one system, sent through a relay, and then delivered by another, each step may introduce its own authentication domain. 5. Misconfigured third-party connectors in Google Workspace or Microsoft 365 Both platforms allow you to route email through third-party gateways for security scanning. If the gateway uses its own domain for SPF or DKIM rather than your domain, alignment fails even if the platform is correctly configured.

How to diagnose alignment failures with DMARC reports

DMARC aggregate reports sent to your rua address contain the information you need. The key fields to look at are:

• Source IP: which server actually sent the email
• SPF domain: which domain authorized the sending server
• DKIM domain: which domain signed the email
• DMARC result: pass, fail, or something else

If DMARC fails, the report will show you the aligned domain for SPF and DKIM. Compare that to your From domain. A mismatch is an alignment failure. The source IP tells you which service or server is responsible. Without a tool, aggregate reports are XML files that are tedious to parse manually. This is where DMARCFlow earns its place in your workflow: it parses these reports automatically and surfaces alignment failures by source domain, so you can identify which vendor or internal system is causing the problem rather than reading XML by hand.

How to fix alignment failures

Option 1: Use a custom sending domain Configure your third-party platforms to send from a subdomain of your domain, such as marketing.example.com or emails.example.com. Set up proper SPF, DKIM, and DMARC for that subdomain. This is the cleanest approach for marketing and notification email. Option 2: Include third-party servers in your SPF record If a third party sends email with your From address, you can add their mail servers to your SPF record. This makes their SPF domain align with your From domain. However, this requires careful management and becomes unwieldy if many third parties are involved. Option 3: Use DKIM signing through your domain Some platforms allow you to set up DKIM keys under your own domain rather than theirs. This is the preferred approach where available because it makes DKIM alignment pass without modifying SPF. Option 4: Adjust alignment mode to relaxed If strict alignment is not achievable for a particular sending flow, relaxed alignment reduces the risk of false rejections while still preventing exact-domain spoofing. This is a reasonable operational compromise while you work on the root cause.

FAQ

Can DMARC pass if SPF and DKIM both fail? Yes. DMARC passes if either SPF or DKIM passes and aligns with the From domain. It does not require both authentication mechanisms to pass. This is why DMARC policy can be set to reject even when one authentication mechanism fails, as long as the other provides a valid aligned result. What is relaxed alignment vs strict alignment? Relaxed alignment allows the From domain and the aligned domain to be in a parent-child relationship (e.g., newsletter@example.com aligns with example.com). Strict alignment requires exact match. Most organizations use relaxed alignment as a practical matter. Why do marketing emails from my domain fail DMARC? Because the marketing platform is sending the email from its own infrastructure, not yours. The SPF and DKIM results will show the platform's domain, not yours. Fix this by configuring the platform to send through your own domain's mail system or by using a subdomain dedicated to marketing that has its own DMARC record. How do I check alignment manually in email headers? Look at the Authentication-Results header. Find the SPF domain and the DKIM domain. Compare them to the From address domain in the message headers. If neither matches, DMARC alignment will fail. Does forwarding break DMARC alignment? Forwarding can break alignment because the forwarding server may rewrite the envelope sender or add its own authentication results. The forwarded message may fail DMARC even if the original message passed. This is a known limitation of DMARC in forwarding scenarios.

Practical checklist

Use this when you are debugging a DMARC alignment failure: 1. Identify the From address domain in the email header (the RFC 5322 From field). 2. Check the SPF domain in Authentication-Results: does it match the From domain? 3. Check the DKIM domain in Authentication-Results: does it match the From domain? 4. If neither matches, find the source IP and identify which service or system is sending the email. 5. Either update SPF to include that service's servers, configure DKIM signing under your domain, or move that sending flow to a subdomain with its own DMARC record. 6. If the flow cannot be fixed immediately, set alignment to relaxed as a holding measure while you work on the permanent fix.

The short version

SPF and DKIM verify that an authorized server sent the email. DMARC verifies that the From address matches that server's domain. These are two separate checks and both must pass for a DMARC pass result. When you see SPF pass DKIM pass DMARC fail, the problem is almost always that the sending infrastructure uses a different domain than the From address. Identifying which domain is authenticated and why it does not match your From domain is the diagnostic step that leads to the fix. If you are managing this manually, DMARC aggregate reports give you everything you need. If you want that data surfaced quickly with clear attribution by sending domain, DMARCFlow parses those reports and flags alignment failures in a dashboard rather than making you read XML.