ThisCalculator

Everyday

SPF & DKIM Pass But DMARC Fails: Why

Updated · Standard formula, shown below

SPF & DKIM Pass But DMARC Fails: Why

This article explains why a domain can pass both SPF and DKIM checks yet still fail DMARC, and what that means for your email deliverability. You’ll learn the specific alignment rules that DMARC enforces, see concrete examples of passing and failing configurations, and get practical steps to fix the problem. The short answer is that DMARC requires not just a valid SPF or DKIM signature, but also that the domain in that signature aligns with the domain in the email’s From address.

Background: What Each Check Actually Verifies

SPF (Sender Policy Framework) and DKIM (DomainKeys Identified Mail) are two independent email authentication methods. SPF checks whether the sending server’s IP address is listed in the domain’s DNS TXT record. DKIM uses a cryptographic signature in the email header to verify that the message wasn’t altered after it was signed. Both are useful, but neither was designed to stop domain spoofing on its own.

DMARC (Domain-based Message Authentication, Reporting, and Conformance) was introduced later to solve a specific gap: an attacker could send mail that passes SPF or DKIM for a domain they control, while the visible From address shows a victim’s domain. DMARC adds a policy layer that tells receiving servers what to do if authentication fails, and it requires alignment between the domain in the From header and the domain used in SPF or DKIM.

How DMARC Alignment Works

DMARC doesn’t care whether SPF or DKIM passes in isolation. It only cares about two things:

  • SPF alignment: The domain in the envelope From (the MAIL FROM command, often the Return-Path) must match the domain in the visible From header, or be a subdomain of it.
  • DKIM alignment: The domain in the DKIM signature’s d= tag must match the visible From domain, or be a subdomain of it.

If at least one of these two alignments passes, DMARC passes. If neither aligns, DMARC fails — even if both SPF and DKIM individually pass for their own domains.

For example, a legitimate marketing email might be sent through a third-party service like SendGrid or Mailchimp. The Return-Path could be bounces@sendgrid.net, and the DKIM signature could have d=sendgrid.net. The visible From is news@yourdomain.com. SPF passes for sendgrid.net, DKIM passes for sendgrid.net, but neither aligns with yourdomain.com. DMARC sees this as a failed check.

Common Reasons Your Domain Fails DMARC Despite Passing SPF and DKIM

Here are the most frequent causes, in order of likelihood:

  1. Third-party senders using their own domains: Your email service provider (ESP) may sign with their own domain, not yours. You need to configure them to sign with your domain, or set up a subdomain that you control.
  2. SPF alignment broken by forwarding: When an email is forwarded, the receiving server may change the Return-Path to the forwarding service’s domain. The original DKIM signature may still be valid, but if the DKIM domain doesn’t align with the From, DMARC fails.
  3. DKIM selector not published: Your DKIM signature might be valid, but if the public key isn’t published in DNS under the correct selector, the receiving server can’t verify it — so it doesn’t count as a pass for DMARC.
  4. Multiple From domains in one message: Some systems rewrite the From header during mailing list processing, breaking alignment even if the original signature was fine.
  5. Subdomain vs. root domain mismatch: DMARC alignment allows subdomains by default (relaxed mode), but if you use strict alignment and send from a subdomain while the From is the root domain, it fails.

How to Diagnose Your Specific Failure

You don’t have to guess. Most DMARC failures are visible in the aggregate reports that DMARC generates. Here’s a step-by-step approach:

  1. Check your DMARC record: Use a DNS lookup tool to see if you have a DMARC TXT record at _dmarc.yourdomain.com. If it’s missing, that’s a separate problem — no DMARC record means no DMARC enforcement, but it also means you’re not protected.
  2. Look at the authentication results in the raw email header: Most email clients allow you to view the full source. Find the Authentication-Results header. It will show spf=pass, dkim=pass, and dmarc=fail with a reason like align=no.
  3. Identify which alignment failed: The header will say something like header.from=example.com, dkim=pass (d=sendgrid.net). That tells you the DKIM domain doesn’t match the From domain.
  4. Check your SPF record: Ensure the sending server’s IP is included. If you use a third-party sender, they should have provided an SPF include line for you to add.
  5. Check your DKIM selector: The signature in the header will have s=selector. Verify that a DNS TXT record exists at selector._domainkey.yourdomain.com.

Fixing the Problem: Practical Steps

Once you know which alignment is failing, the fix is usually one of these:

  • Configure your ESP to sign with your domain: Most major email platforms have a settings page where you add your domain for DKIM. They’ll give you a DNS record to publish. Do that, and their signatures will use d=yourdomain.com.
  • Set up a dedicated subdomain: If you can’t get the ESP to sign with your root domain, create a subdomain like mail.yourdomain.com and have them use that. DMARC alignment allows subdomains, so this works.
  • Add the ESP’s SPF include: Your SPF record should include the third-party’s sending IPs. For example, add include:sendgrid.net to your existing SPF TXT record.
  • Use a separate From domain for bulk mail: Some organizations use a different domain for marketing emails entirely, and configure DMARC for that domain separately. This keeps transactional mail clean.
  • Consider DMARC strict mode only after you’re sure: Start with relaxed alignment (adkim=r; aspf=r) which allows subdomains, then tighten later if you want.

Common Misconceptions and Pitfalls

A frequent misunderstanding is that “SPF pass� in the header means DMARC should pass. That’s only true if the SPF domain aligns with the From. Another pitfall is assuming DKIM is enough — DKIM alignment is separate from DKIM validation. A valid signature for d=otherdomain.com does nothing for your DMARC.

Another issue: some email services use a different envelope From for bounce handling. If your SPF record only includes your own mail server, but the Return-Path is set to a third-party, SPF will fail for the envelope domain — and if DKIM also doesn’t align, DMARC fails. Always check the actual envelope, not just the visible From.

Finally, don’t set your DMARC policy to p=reject until you’ve monitored reports for at least a week. A misconfigured third-party sender could cause all your mail to be rejected, including legitimate transactional messages.

Frequently Asked Questions

Why does my email show SPF pass and DKIM pass but DMARC fail?

Because DMARC requires domain alignment. If the SPF domain (Return-Path) and the DKIM domain (d= tag) don’t match the domain in the From header, DMARC considers the authentication as not aligned, even though each individual check passed for its own domain.

What does “align=no� mean in a DMARC report?

It means the domain used in SPF or DKIM does not match the domain in the From header. The report will usually specify which one — for example, spf=pass (align=no) or dkim=pass (align=no).

Can I have DMARC pass with only DKIM alignment?

Yes. DMARC passes if either SPF or DKIM aligns. So if your DKIM signature uses your domain and it validates, you don’t need SPF to align. Many third-party senders rely on DKIM alignment alone.

Do I need to fix SPF alignment if DKIM alignment already works?

No, but it’s good practice. If DKIM alignment is solid, DMARC will pass. However, some receiving systems are more strict about SPF, and having both aligned increases deliverability. Fixing SPF alignment is relatively easy if your ESP provides an include.

How long does it take for DMARC changes to take effect?

DNS changes can take a few minutes to a few hours, but DMARC reports are sent daily. You should see the effect within 24–48 hours. If you change your DMARC policy from none to quarantine or reject, allow at least a week of monitoring first.

What if I don’t have a DMARC record at all?

Then DMARC is not enforced. Your email might still be delivered, but you have no way to tell receiving servers what to do with unauthenticated mail, and you’re not getting reports. Adding a DMARC record with p=none is the first step to visibility.

Related

Method: the standard formula for this calculation, rounded as each result states. See how the calculators work or report an error.