DMARC alignment explained: why SPF and DKIM can pass but DMARC still fails

One of the most common questions we get from IT leads goes something like this: "Our SPF passes and DKIM is signing. So why are legitimate emails failing DMARC?" The answer is almost always alignment, and it is the part of DMARC that catches people out.

SPF and DKIM each answer a technical question. DMARC adds a second question on top: does the domain those checks authenticate actually match the domain your recipient sees? That second question is alignment, and understanding it is the difference between a DMARC policy you can trust and one that quietly blocks your own mail.

The domain you see is not always the domain that gets checked

Every email you send involves more than one domain, even if you only ever think about one. When someone receives a message from you, they see the address in the From header, for example [email protected]. That is the visible, human-facing domain. It is the one attackers want to impersonate, and it is the one DMARC exists to protect.

But underneath, two other domains are in play:

• The Return-Path (also called the envelope sender or MAIL FROM), which is what SPF actually checks.
• The d= domain in the DKIM signature, which is what DKIM actually signs and validates against.

Here is the crucial point. SPF and DKIM do not care about the From header at all. SPF validates the Return-Path. DKIM validates its own d= domain. Neither of them, on their own, guarantees that the address your recipient reads is genuine. An attacker can put your domain in the From header while using a completely different domain for the Return-Path and DKIM signature, and both SPF and DKIM can pass with flying colours.

DMARC was built to close exactly this gap. It insists that at least one of SPF or DKIM not only passes, but passes for a domain that aligns with the From header your recipient sees. If you are new to the three protocols, our plain-English guide to DMARC sets the scene.

What alignment actually means

Alignment is simply a comparison between the From domain and the domain that SPF or DKIM authenticated. If they match, the check is aligned. If they do not, it is not, and that check does not count towards DMARC.

DMARC checks two forms of alignment independently:

• SPF alignment. The Return-Path domain (that SPF validated) is compared with the From domain.
• DKIM alignment. The d= domain in the DKIM signature is compared with the From domain.

DMARC passes if either SPF is aligned and passing, or DKIM is aligned and passing. You do not need both. But you do need at least one aligned pass, and this is where legitimate mail so often falls down.

A worked example

Say you use a marketing platform to send newsletters from [email protected]. The platform sends on your behalf. Two things can happen:

• The platform uses its own domain, for example bounces.mailplatform.com, as the Return-Path. SPF checks that domain, and it passes, because the platform's servers are authorised to send for it. But mailplatform.com does not match yourfirm.co.uk. SPF is passing but not aligned. It does not count for DMARC.
• If you have not set up DKIM signing with your own domain on that platform, the DKIM signature (if any) uses the platform's d= domain too. That also fails alignment.

The result: SPF passes, DKIM may pass, and DMARC still fails, because neither passing check is aligned to yourfirm.co.uk. Your genuine newsletter looks, to a DMARC-enforcing receiver, exactly like something an outsider spoofed.

Relaxed versus strict alignment

DMARC gives you two alignment modes, and they behave differently. You set them in your DMARC record using the aspf tag for SPF and the adkim tag for DKIM. The default for both is relaxed.

Relaxed alignment (the default)

In relaxed mode, the two domains only need to share the same organisational domain. Subdomains are treated as part of the same family. So if your From domain is yourfirm.co.uk and DKIM signs with mail.yourfirm.co.uk, that is aligned in relaxed mode, because both roll up to yourfirm.co.uk.

This is what most organisations want. It gives you room to use subdomains for different mail streams without breaking DMARC.

Strict alignment

In strict mode, the domains must match exactly. mail.yourfirm.co.uk would not align with yourfirm.co.uk under strict rules. Strict alignment offers marginally tighter control but breaks easily, and for most senders it causes more problems than it solves. Unless you have a specific reason, relaxed is the sensible default.

Why this trips up legitimate senders

Alignment problems almost always come from third parties sending mail in your name. The usual suspects:

• Email marketing and newsletter platforms
• CRM and helpdesk systems that email customers
• Invoicing, booking and payment tools
• Payroll, HR and survey services
• Anything that sends "from" your domain but runs on someone else's infrastructure

Each of these can pass SPF and DKIM against its own domain and still fail alignment against yours. The fix is not to abandon DMARC. It is to configure each service correctly so that at least one authentication method aligns to your domain.

How to fix alignment

You have two levers, and you only need one of them to succeed per sending source.

Align DKIM (the reliable choice)

The strongest and most durable fix is to set up DKIM signing with your own domain at each third-party sender. Most reputable platforms let you add a custom DKIM key: you publish some DNS records they give you, and they then sign as yourfirm.co.uk rather than their own domain. Once the d= domain is yours, DKIM aligns, and DMARC passes regardless of what the Return-Path does.

DKIM alignment is preferred because it survives forwarding. When a message is forwarded, SPF frequently breaks (the forwarding server is not on your SPF list), but a valid DKIM signature usually travels intact. Our explainer on what DKIM does covers the signing process in more detail.

Align SPF (sometimes possible)

Some platforms let you set a custom Return-Path or bounce domain that sits under your own domain, for example bounce.yourfirm.co.uk. When they do, SPF then aligns. This is a valid route, but it is less common and less resilient than DKIM alignment. See how SPF works for the mechanics.

How to spot alignment failures

You cannot fix what you cannot see, and alignment failures are invisible in normal use because the mail still gets delivered while your policy is at p=none. The evidence lives in your DMARC aggregate reports. These show, for every sending source, whether SPF and DKIM passed and whether they aligned.

A common pattern in the reports is a source where SPF shows "pass" but the SPF alignment column shows "fail", or DKIM passes but with a d= domain that is not yours. That is your list of things to fix before you tighten enforcement. Our guide to reading your DMARC reports walks through what the columns mean.

This is precisely why you should not jump straight to a blocking policy. Work through the reports, get each legitimate source aligned, and only then move towards enforcement. Our safe route to enforcement sets out that sequence.

What alignment does and does not do

Alignment is what gives DMARC its teeth. Without it, DMARC would be no stronger than SPF and DKIM on their own, both of which can be satisfied by an attacker using an unrelated domain. Alignment forces the authentication to be about the domain your recipient actually reads.

What it does not do is judge the content of a message. Alignment only confirms the From domain has been genuinely authorised by its owner. A perfectly aligned email can still carry a phishing payload if it comes from a compromised legitimate account. DMARC alignment protects the domain, not the mailbox behind it.

Alignment is the quiet mechanism that decides whether DMARC helps you or hurts you. Get it right for every service that sends in your name, verify it in your reports, and you can move to enforcement with confidence that your own mail will keep flowing. The technical detail of how receivers evaluate alignment is set out in RFC 7489, the DMARC specification, but for day-to-day operations the rule is simple: an authentication check only counts if the domain it validates lines up with the domain your recipient sees.