Your email can show a green check for SPF and DKIM and still be flagged as failing DMARC – a mismatch that lets spoofed messages slip through and hurts deliverability. The reason is alignment, the rule that forces the domain that authenticates the message to match the address shown in the From header.

Why SPF and DKIM aren’t enough on their own

SPF (Sender Policy Framework) validates the Return-Path address, the envelope sender used for bounces. That address often belongs to a mailing-service provider rather than the brand you see in the inbox.

DKIM (DomainKeys Identified Mail) verifies the domain attached to the cryptographic signature in the header. The signer can be the sender’s own domain or a third-party service’s domain.

Both checks can pass, yet DMARC (Domain-based Message Authentication, Reporting & Conformance) will still report a failure if neither the Return-Path nor the DKIM signing domain aligns with the visible From address.

The four most common alignment failures

  • Provider-owned domains – Many bulk-mail platforms set their own Return-Path and sign with their own DKIM key. If you never replace those with your own domain, DMARC sees a mismatch.
  • Email forwarding – When a downstream server forwards a message, the SPF check usually breaks because the forwarding IP isn’t listed in your SPF record. If the DKIM signature also gets altered en route, DMARC has nothing to fall back on.
  • Broken DKIM – A mis-configured key or DNS error can cause DKIM to fail. In that case DMARC relies on SPF, and if SPF’s Return-Path isn’t aligned you lose again.
  • Strict alignment mode – Setting aspf=s or adkim=s tells DMARC to demand an exact domain match, not just a parent-domain relationship. Subdomains that differ even by a dot will trigger a failure.

How to spot the problem

Open the raw source of the offending message and locate the Authentication-Results header. It will list the outcome of SPF, DKIM and DMARC checks, along with the domains each test evaluated.

  • Compare the smtp.mailfrom (the Return-Path) with the domain in the From header.
  • Compare the header.d tag inside the DKIM-Signature block with the From domain.

If neither comparison yields a match, alignment is the culprit.

Fixes that get DMARC to pass

  1. Use an aligned Return-Path – Most sending platforms let you publish a custom bounce domain. Point that domain to a DNS zone you control and add it to your SPF record.
  2. Deploy an aligned DKIM signature – Set the d= tag in the DKIM signature to your own domain (or a sub-domain you own) and publish the corresponding public key in DNS. Because DKIM survives most forwarding scenarios, it is the most reliable way to achieve alignment.

Takeaway

Passing SPF and DKIM is only half the battle; without domain alignment DMARC will still flag your messages as unauthenticated. Align either the Return-Path or the DKIM signing domain with the visible From address, verify the settings in your raw headers, and adjust strictness as needed. Once alignment is in place, DMARC will report a pass, protecting your brand and improving inbox placement.