DNSVerdictAll toolsGuidesHow it works

DMARC fails even though SPF and DKIM pass: fixing alignment

Published · Updated

DMARC does not ask only whether SPF or DKIM passed. It asks whether the domain that passed is the same as, or a subdomain of, the domain in the visible From: address. This is identifier alignment (RFC 7489 §3.1). When a sending service signs with its own domain (d=esp.example) and uses its own bounce domain in the envelope (bounce.esp.example), both checks pass for the service’s domain, neither aligns with yours, and dmarc=fail appears in the headers. The fix is to make at least one of the two use your domain: publish the service’s custom DKIM keys (most reliable) or a custom return-path/MAIL FROM domain (SPF alignment).

How to confirm it is alignment

Open the full headers of a failing message and compare three domains (the email header analyzer lists them; the layout of the underlying lines is explained in How to read email headers):

Authentication-Results: mx.receiver.example;
    spf=pass smtp.mailfrom=bounce.esp.example;
    dkim=pass header.d=esp.example;
    dmarc=fail header.from=yourdomain.example

If neither smtp.mailfrom nor header.d matches header.from at the organizational-domain level, you have this problem. Check the policy that applies with the DMARC checker and the sender’s authorized IPs with the SPF checker.

What alignment means

RFC 7489 §3.1.1 and §3.1.2 define two modes, selected in your DMARC record with adkim and aspf:

ModeTag valueDKIM: d= must beSPF: envelope domain must be
Relaxed (default)adkim=r, aspf=rSame organizational domain as From:Same organizational domain as From:
Strictadkim=s, aspf=sExactly the From: domainExactly the From: domain

The organizational domain (§3.2) is the registered domain: a public-suffix list is used and one label is added to the longest matching suffix. With relaxed alignment, From: news@example.com aligns with d=mail.example.com, because both have the organizational domain example.com. With strict alignment it does not. Note that RFC 7489 §3.1.1 says d=com can never produce alignment.

DMARC passes if either SPF or DKIM passes and aligns. You only need one; both is better because forwarding breaks SPF and mailing lists often break DKIM.

Trade-off on strict mode: Google’s guidance states that relaxed alignment “typically provides sufficient spoofing protection”, while strict alignment “can result in messages from associated subdomains to be rejected or sent to spam”. Keep aspf and adkim at the default unless a subdomain you do not control sends mail for you. Moving to p=reject while alignment is still broken blocks your own legitimate mail, so read aggregate reports at p=none first.

Fix by provider

ProviderWhy it can be unalignedWhat aligns itDocumentation
Google WorkspaceThird-party senders use their own envelope domain; DKIM not enabled for your domainGenerate the DKIM key in Admin console and start authenticationDKIM, DMARC
Microsoft 365Default DKIM signing uses the *.onmicrosoft.com domainAdd the two DKIM CNAME records for your custom domain and enable signingMicrosoft Learn
MailchimpEnvelope sender is a Mailchimp domain such as mcsv.netAuthenticate the domain: two DKIM CNAMEs plus a DMARC TXT recordMailchimp
SendGridWithout domain authentication the bounce address uses SendGrid’s default return-path subdomain, not your own labelDomain authentication with a custom return pathTwilio SendGrid
Amazon SESDefault MAIL FROM is an Amazon domainCustom MAIL FROM subdomain (MX + SPF TXT) and DKIM for your domainAWS

Google Workspace

When Workspace itself sends your mail, the fix is to turn DKIM on for your domain. Per Google’s documentation: in the Admin console go to Apps > Google Workspace > Gmail > Authenticate email, select the domain, Generate New Record (2048-bit if your DNS host allows it; the default selector prefix is google), publish the TXT record at google._domainkey, wait up to 48 hours, then click Start authentication. For mail that a third-party service sends on your behalf, Google’s DMARC page tells you to confirm the provider’s envelope sender domain matches your domain and that its IPs are in your SPF, or to route that mail through Google’s SMTP relay.

Microsoft 365

Microsoft signs with the *.onmicrosoft.com domain automatically. Microsoft’s documentation says DKIM passes DMARC only if the signing domain and the From domain align, so for a custom domain you must configure signing for that domain. Create two CNAME records, selector1._domainkey and selector2._domainkey, with the targets shown in the Defender portal, then enable DKIM signing for the domain. The target values vary per tenant; read them with Get-DkimSigningConfig -Identity yourdomain.example | Format-List Selector1CNAME,Selector2CNAME rather than copying an example.

Mailchimp

In Mailchimp go to Account & billing > Domains, choose Start authentication next to the verified domain, and either use the automatic Entri flow or add the records by hand: two CNAMEs for DKIM and a TXT at _dmarc. Mailchimp’s help pages state that the envelope sender is based on Mailchimp’s own servers and usually contains mcsv.net, mcdlv.net, mailchimpapp.net or rsgsv.net, so SPF will not align for your From domain; the aligned path for marketing campaigns is custom DKIM. The pages we read do not document a custom return-path setting for campaigns.

SendGrid

Under Settings > Sender Authentication > Domain Authentication, enter the root domain and open Advanced Settings. With automated security on (the default) SendGrid asks for CNAMEs for the branded mail host and s1._domainkey / s2._domainkey, plus a _dmarc TXT. The Custom return path option replaces the default random four-character subdomain used for bounces with a label you choose (a CNAME pointing to sendgrid.net). SendGrid warns that a custom return path matching an existing CNAME overwrites it, so check your current records first. If your DNS host appends the domain automatically, enter only the host part (em123), not the full name.

Amazon SES

SES signs with Easy DKIM when you verify a domain identity; publish the CNAME records the console shows. For SPF alignment, set a custom MAIL FROM domain: choose a subdomain you do not send mail from, publish the MX record SES gives you (it points to the regional feedback endpoint) and an SPF TXT record such as v=spf1 include:amazonses.com ~all. AWS notes that for DMARC the From domain must match the MAIL FROM domain or be a subdomain of it, and that aspf=s breaks this because the MAIL FROM is a subdomain. The exact MX and TXT values differ per region; copy them from the SES console rather than from an example.

FAQ

Is one aligned pass enough? Yes. RFC 7489 requires an aligned pass from SPF or DKIM, not both.

Should I choose strict alignment for security? Rarely. Strict mode stops a subdomain from passing for the parent, which also affects your own legitimate subdomain senders. Relaxed is the default and the common recommendation.

I enabled custom DKIM, but old mail still fails. Why? Messages already sent keep their original signatures. Test with a new message, and allow DNS propagation time (providers quote up to 48 hours).

Sources

Tools used

DMARC Record CheckerSPF Record CheckerEmail Header Analyzer