5 min read
DMARC alignment: why SPF and DKIM can pass and DMARC still fails
DMARC needs SPF or DKIM to pass and to align with the From domain. Learn what alignment means, relaxed versus strict, and the most common way legitimate mail fails.
Passing is not enough
A message can pass SPF and DKIM and still fail DMARC. The reason is alignment: DMARC does not only ask whether a check passed, it asks whether the domain that passed is the same as the domain in the From address.
What SPF checks, and what it aligns to
SPF checks the envelope sender, also called the Return-Path or MAIL FROM, which people never see. If your helpdesk sends mail from your address but uses its own bounce domain, SPF passes for the helpdesk domain, which does not match your From domain. SPF passes; it does not align.
What DKIM checks, and what it aligns to
DKIM checks the signature, and the d= value names the signing domain. If a marketing platform signs with its own domain, DKIM passes for that domain, which again does not match your From domain. Setting up a custom signing domain, usually by adding a CNAME the service gives you, makes the signature align.
Relaxed and strict
In relaxed mode, the two domains only have to share the same organizational domain, so mail.example.com aligns with example.com. In strict mode they must match exactly. Relaxed is the default and is what almost everyone should use.
You only need one
DMARC passes when either SPF or DKIM passes and aligns. That is useful: forwarding often breaks SPF, but a DKIM signature survives, so signing everything with an aligned DKIM key is the most robust setup.
How to find your failures
Aggregate reports list SPF and DKIM results both as raw and as aligned. A row where the raw result is pass and the aligned result is fail is the signature of this exact problem, and the fix is nearly always to configure a custom DKIM domain at that service.