DMARC Alignment Explained: Why SPF and DKIM Can Pass While DMARC Fails

This is the failure that makes experienced admins question their DNS. Every record is published. dig shows the SPF record, the DKIM selector resolves, the DMARC policy is in place. Third-party checkers report SPF pass and DKIM pass. And DMARC still fails — on mail you expected to be legitimate.

The explanation is not in any single record. It is in how DMARC relates the records to each other. Raw DNS lookups show protocols in isolation, but DMARC depends on how they line up: a domain can publish SPF and DKIM records and still fail DMARC if the authenticated SPF domain or the DKIM signing domain does not align with the visible From domain.

Alignment, in one paragraph

DMARC sits on top of SPF and DKIM and adds one requirement: the domain that SPF or DKIM authenticated must match the domain in the visible From: header your recipients see. Passing is not enough — it has to pass for your domain. DMARC is satisfied when either SPF or DKIM is both passing and aligned; you do not need both.

The two alignments

SPF alignment

SPF authenticates the envelope-from address — the Return-Path or bounce address used in the SMTP conversation — not the From: header. SPF alignment compares the envelope-from domain with the header From domain.

This is where third-party senders break things. When a newsletter platform or CRM sends on your behalf, the bounce address is usually the provider's own domain. SPF passes — but it passes for their domain, not yours. A raw SPF lookup on your domain shows a correct record and tells you nothing about this.

DKIM alignment

DKIM authenticates the d= domain in the DKIM-Signature header of each message. DKIM alignment compares that d= value with the header From domain.

The same third-party problem applies. If your sending platform DKIM-signs with its own domain, the signature verifies correctly — for their domain. Unless the platform signs with your domain in the d= tag (which requires you to publish their DKIM selector under your domain), DKIM does not align with you.

Relaxed vs strict: the adkim and aspf tags

Your DMARC record controls how close the match has to be with two tags, adkim= and aspf=. Both default to relaxed:

• Relaxed: the organizational domain must match. Mail from news.example.com aligns with a From domain of example.com.
• Strict: the domains must match exactly. news.example.com does not align with example.com.

Strict mode breaks legitimate subdomain sending and multi-brand setups. Keep both tags relaxed unless you personally control every system that sends as your domain — and even then, change one at a time and watch the reports.

The classic failure pattern

Put the pieces together and the most common real-world DMARC failure looks like this:

1. You onboard a newsletter platform. Their setup guide says to add their SPF include and publish their DKIM keys. You do both correctly.
2. Their SPF include makes SPF pass — against their bounce domain.
3. They DKIM-sign every message with their own domain — the signature verifies.
4. Your DMARC record looks at the results, finds neither SPF nor DKIM aligned with your From domain, and DMARC fails. With p=reject, receivers reject mail you expected to be legitimate.

A ~all soft-fail in your SPF record does not soften this. Soft-fail changes what SPF reports, not whether SPF aligns. If DKIM is also failing alignment and SPF does not produce an aligned pass, a strict DMARC policy rejects the mail.

The fix has two halves, and both live outside your main SPF record: a custom MAIL FROM subdomain so SPF authenticates your domain (SPF alignment), and DKIM signing with your domain in the d= tag via the provider's selector (DKIM alignment). The Amazon SES alignment guide walks through both halves concretely, and the DKIM selector guide explains the selector DNS pattern providers use.

How to diagnose an alignment failure

Guessing from DNS records alone is what makes this failure expensive. Diagnose it on real mail instead:

1. Read one delivered message. Send to an inbox you control and inspect the Authentication-Results header. The signature of an alignment problem is spf=pass, dkim=pass, dmarc=fail on the same message — both mechanisms working, neither for your domain.
2. Compare the domains. In that same header or the raw message, check the Return-Path domain and the DKIM-Signature d= tag against your From domain. The mismatch is usually obvious once you look at the right fields.
3. Read your aggregate reports. The rua mailbox in your DMARC record collects per-source pass/fail data with alignment results over time — it shows exactly which sending sources fail alignment and how much of your volume they represent. The API vs DMARC reporting guide compares report data with current DNS audit data.
4. Audit the DNS posture. The free checker gives an instant read on your published SPF, DKIM, and DMARC records so you can rule out record-level problems before chasing alignment.

Move to enforcement only after alignment is proven

p=none is intentional while you are still discovering senders: it requests no receiver enforcement while the aggregate reports show you the truth about alignment across all your sources. Once the reports show consistent aligned passes, move to p=quarantine, then p=reject. Starting at p=reject turns every undiscovered alignment gap into rejected mail.

Frequently asked questions

What is DMARC alignment?

DMARC alignment means the domain authenticated by SPF (the envelope-from domain) or by DKIM (the d= signing domain) matches the domain in the visible From: header. DMARC passes when at least one of SPF or DKIM both passes and aligns.

Can DMARC pass if only SPF or only DKIM is aligned?

Yes. DMARC needs just one aligned, passing mechanism. A common healthy setup is aligned DKIM with SPF failing alignment (for example, when a provider handles bounces on its own domain) — DMARC still passes on the DKIM result.

What is the difference between relaxed and strict alignment?

Relaxed alignment (the default) requires only the organizational domain to match, so subdomains align with the parent domain. Strict alignment requires an exact domain match. The adkim= and aspf= tags in your DMARC record control this per mechanism.

Why does DMARC fail when SPF and DKIM both pass?

Because passing and aligning are different checks. SPF can pass for a third-party bounce domain and DKIM can verify for a third-party signing domain while neither matches your From domain. DMARC fails unless at least one of them authenticates your domain.

How do I check alignment for my domain?

Inspect the Authentication-Results header on a real delivered message and compare the Return-Path domain and DKIM d= tag with your From domain. For ongoing visibility, publish a rua tag in your DMARC record and read the aggregate reports, or run the free checker for the DNS side.