Why does alignment sometimes fail even if SPF/DKIM passes?
Still have a question, spotted an error, or have a better explanation or a source we should cite?
Here's a thing that trips up a lot of senders: your DMARC report shows failures, but when you look closer, SPF passed and DKIM passed. How?
Because DMARC doesn't just ask "did authentication pass?" It asks "did authentication pass for the right domain?"
That's alignment. And it's a separate check.
Say your From address is newsletter@yourbrand.com. You send through an ESP that uses sendingserver.com as the envelope sender. SPF passes for sendingserver.com. But sendingserver.com doesn't match yourbrand.com, so DMARC alignment fails on the SPF side.
Same with DKIM. If your ESP signs messages with d=clicks.youresp.com instead of d=yourbrand.com (or a subdomain of it), DKIM passes the signature check but fails DKIM alignment.
For DMARC to pass, at least one of SPF or DKIM needs to both pass AND be aligned with the From domain. When neither is aligned, you get a DMARC fail regardless of whether individual checks passed.
The fix is usually one of two things: configure your ESP to sign with your own domain (custom DKIM), or add the ESP's sending IPs and domains to your SPF record in a way that aligns with your From domain. Check your DMARC aggregate reports to see exactly which sources are failing and why. Our free Review My Emails DMARC Parser can help you decode those reports quickly.
Contributors
Who worked on this answer
Every name links to their profile. Every company links to their site. Real people, real accountability.
