DKIM alignment explained: why SPF and DKIM pass but DMARC still fails

A message can "pass SPF" and "pass DKIM" and still fail DMARC. The reason is alignment: DMARC does not only ask whether a check passed, it asks whether the passing domain matches the domain in the visible From address.

The short version

• SPF (RFC 7208) checks the envelope sender (MAIL FROM, later the Return-Path header), not the From header the user sees.
• DKIM (RFC 6376) signs the message. The signing domain is the d= tag.
• DMARC (RFC 7489) passes if SPF passes and aligns, or DKIM passes and aligns.

A message that passes both and still fails

From: Billing <[email protected]>
Return-Path: <[email protected]>
DKIM-Signature: ... d=example.net ...

SPF passes for example.net, DKIM passes for example.net, but neither matches example.com. DMARC fails.

The fix is to make both identifiers use your own domain:

From: Billing <[email protected]>
Return-Path: <[email protected]>
DKIM-Signature: ... d=example.com ...

Relaxed or strict

With relaxed alignment (adkim=r, aspf=r, the default), only the organizational domains must match, so bounces.example.com aligns with example.com. With strict alignment (s) they must be identical. Relaxed is the right choice for almost everyone, because it lets you use a dedicated return-path subdomain.

_dmarc.example.com.  IN TXT  "v=DMARC1; p=none; rua=mailto:[email protected]; adkim=r; aspf=r; pct=100"

Practical checklist

1. List every system that sends as your domain (app, marketing tool, helpdesk, CRM, Workspace or Microsoft 365).
2. Give each one a custom return-path subdomain such as bounces.example.com with its own SPF record. It keeps the root record short and away from the 10-lookup limit.
3. Sign with your own domain (d=example.com), RSA keys of at least 2048 bits.
4. Start DMARC at p=none with a rua= address, read the reports, then move to quarantine and reject.
5. Look at a real delivered message: Authentication-Results should show dmarc=pass and the aligned domains.

Gmail and Yahoo have required all three for bulk senders since February 2024 (Google email sender guidelines).

I wrote the longer version, with the full step-by-step DNS setup and common mistakes, on the Pidgely blog: SPF, DKIM and DMARC explained. Pidgely is an email API; there is also a free SPF, DKIM and DMARC checker that needs no signup.