MXCorrect

← Blog · October 1, 2026

SPF and DKIM Pass but DMARC Fails? How to Fix DMARC Alignment

This is one of the most confusing results in email authentication. You open the headers of a message that landed in spam, and you see spf=pass, dkim=pass and then dmarc=fail. How can both checks pass and DMARC still fail? The answer is alignment. DMARC does not just ask whether SPF or DKIM passed. It asks whether they passed for the domain your recipient actually sees. This guide explains how alignment works, the most common reasons it breaks, and how to fix each one.

What DMARC actually checks

An email has several domain identities, and most people only ever look at one of them:

  • Header From (RFC5322.From): the address shown in the recipient’s mail client, such as newsletter@example.com. DMARC protects this domain.
  • Envelope sender (RFC5321.MailFrom, also called Return-Path or bounce address): the address the sending server gives in the SMTP MAIL FROM command. SPF is checked against this domain, not against the Header From.
  • DKIM signing domain: the d= tag in the DKIM-Signature header. DKIM verifies the signature for this domain.

SPF and DKIM can pass for any domain. A message from you@example.com sent through an email service provider can pass SPF for bounces.esp-provider.net and pass DKIM for esp-provider.net. Both results are valid, but neither one says anything about example.com.

DMARC passes only when at least one of these is true:

  1. SPF passes and the envelope sender domain aligns with the Header From domain, or
  2. DKIM passes and the d= domain aligns with the Header From domain.

You need one aligned pass, not both. In practice you should aim for both, for reasons covered below.

Relaxed vs strict alignment

Your DMARC record controls how closely the domains have to match, using two optional tags:

  • aspf: alignment mode for SPF
  • adkim: alignment mode for DKIM

Both accept r (relaxed, the default) or s (strict).

Relaxed alignment (r)

The domains only need to share the same organizational domain, meaning the registered domain as determined by the Public Suffix List. So with relaxed alignment, all of these align with a Header From of example.com:

  • example.com
  • mail.example.com
  • bounce.news.example.com

But example.net or example.com.esp-provider.net do not.

Strict alignment (s)

The domains must match exactly. With adkim=s, a DKIM signature with d=mail.example.com does not align with a Header From of example.com.

; Relaxed (default) - recommended for most domains
_dmarc.example.com.  IN TXT  "v=DMARC1; p=quarantine; rua=mailto:dmarc@example.com"

; Strict on both - only if you control every sending path precisely
_dmarc.example.com.  IN TXT  "v=DMARC1; p=quarantine; adkim=s; aspf=s; rua=mailto:dmarc@example.com"

If you set strict alignment and a sender signs with a subdomain, DMARC fails even though everything “passes”. If you never set adkim or aspf on purpose, leave them out and use the relaxed default.

How to diagnose an alignment failure

Send a test message from the affected system to a mailbox you control (Gmail works well) and open the raw message (“Show original” in Gmail). Look at three headers.

1. Authentication-Results

Authentication-Results: mx.google.com;
       dkim=pass header.i=@sendgrid.net header.s=smtpapi header.b=Ab12Cd34;
       spf=pass (google.com: domain of bounces+123@em4567.sendgrid.net designates 149.72.0.1 as permitted sender) smtp.mailfrom="bounces+123@em4567.sendgrid.net";
       dmarc=fail (p=QUARANTINE sp=QUARANTINE dis=QUARANTINE) header.from=example.com

This shows the problem directly. DKIM passed for sendgrid.net, SPF passed for sendgrid.net, and the Header From is example.com. Nothing aligns.

2. Return-Path

The Return-Path header shows the envelope sender the receiving server saw. If its domain is not example.com or a subdomain of it, SPF cannot help you with DMARC.

3. DKIM-Signature

Find the d= tag. If a message carries several signatures, only one of them has to pass and align. A common, healthy setup is one signature from your own domain plus one from the provider.

Your DMARC aggregate reports show the same information at scale. In each record, policy_evaluated gives the aligned DMARC result, and auth_results gives the raw SPF/DKIM results and their domains. A row with auth_results passing and policy_evaluated failing is an alignment failure.

The most common causes and how to fix them

1. Your email service provider signs with its own domain

Marketing and transactional platforms (SendGrid, Mailgun, Amazon SES, Mailchimp, HubSpot, Brevo and others) sign with their own DKIM domain by default. The fix is to set up custom DKIM (sometimes called “domain authentication” or “branded sending”):

  1. In the provider’s dashboard, add and verify your sending domain.
  2. Publish the DNS records the provider gives you, usually CNAMEs under _domainkey: 
    s1._domainkey.example.com.  IN CNAME  s1.domainkey.u1234567.wl.sendgrid.net.
s2._domainkey.example.com.  IN CNAME  s2.domainkey.u1234567.wl.sendgrid.net.
  3. Wait for the provider to verify the records, and turn on signing with your domain if that is not automatic.
  4. Send a test and confirm dkim=pass header.i=@example.com in the headers.

2. The envelope sender (Return-Path) belongs to the provider

Even with SPF including the provider (include:sendgrid.net), SPF is evaluated against the Return-Path domain. If that is em4567.sendgrid.net, your SPF record is never consulted. Many providers support a custom Return-Path / bounce domain on a subdomain you own:

em4567.example.com.  IN CNAME  u1234567.wl.sendgrid.net.

With relaxed alignment, a bounce domain like em4567.example.com aligns with example.com. Not every provider offers this. If yours doesn’t, make sure aligned DKIM is in place, because that is then your only route to a DMARC pass.

3. DKIM was never enabled in Google Workspace or Microsoft 365

If you haven’t configured DKIM for your own domain:

  • Google Workspace signs with a default domain such as example-com.20230601.gappssmtp.com. Generate a key under Apps → Google Workspace → Gmail → Authenticate email, publish the google._domainkey TXT record and click Start authentication.
  • Microsoft 365 signs with yourtenant.onmicrosoft.com. Publish the two CNAMEs (selector1._domainkey and selector2._domainkey) and enable DKIM signing for the domain in the Defender portal.

Until you do this, these platforms usually pass DMARC through aligned SPF alone. That works until a message is forwarded.

4. Strict alignment combined with subdomains

You send from info@example.com, but a provider uses bounce.example.com as the Return-Path or signs with d=mail.example.com. With aspf=s or adkim=s, that fails. Either move to relaxed alignment, or configure the sender to use the exact Header From domain.

5. Forwarding and mailing lists

When a message is forwarded, the forwarding server’s IP is not in your SPF record, so SPF fails. If the forwarder keeps the message intact, an aligned DKIM signature survives and DMARC still passes. Mailing lists that add subject tags or footers break the DKIM signature as well. You can’t fully fix this from the sender side, but you can limit the damage:

  • Always have aligned DKIM, not just aligned SPF. DKIM is the identifier that survives forwarding.
  • Many large receivers rely on ARC (Authenticated Received Chain) headers added by trustworthy intermediaries to override DMARC failures on forwarded mail.
  • Modern list software (Mailman 3, Google Groups) rewrites the From address for domains with p=quarantine or p=reject, which prevents the failure.

6. A third-party system sends “as you” without authentication

Helpdesks, CRMs, invoicing tools and website contact forms often send with your domain in the From header through their own infrastructure. Your aggregate reports will show these as unfamiliar source IPs that fail both alignments. For each legitimate one, set up custom DKIM (and a custom Return-Path if available). If a tool doesn’t support either, change its From address to its own domain or to a dedicated subdomain that you authenticate separately.

Alignment checklist

  1. List every service that sends mail with your domain in the From header. Your DMARC aggregate reports are the most reliable source for this.
  2. For each service, confirm DKIM signs with d= your domain or a subdomain of it.
  3. Where possible, set a custom Return-Path on a subdomain you own, and make sure SPF for that subdomain authorizes the service.
  4. Keep adkim and aspf relaxed unless you have a specific reason not to.
  5. Send a test message from each service and check dmarc=pass in Authentication-Results.
  6. Watch your aggregate reports for at least two weeks before tightening your DMARC policy.

Once every legitimate source produces at least one aligned pass, preferably aligned DKIM, the “everything passes but DMARC fails” result goes away, and you can safely move toward p=quarantine or p=reject.