DMARC fails even though SPF and DKIM pass: alignment explained

What alignment means

DMARC does not only ask whether SPF or DKIM passed. It asks whether the domain that passed matches the domain in the visible From address. For SPF that is the envelope sender (Return-Path) domain. For DKIM it is the d= domain in the signature.

Relaxed and strict

By default alignment is relaxed (adkim=r; aspf=r): the domains need to share the same organisational domain, so mail.example.com aligns with example.com. Strict (s) needs an exact match.

Why it fails with a third-party sender

A newsletter or CRM tool often sends with its own Return-Path domain and signs with its own d= domain. SPF and DKIM then pass, but for the vendor's domain, not yours, so DMARC does not align.

Fix

  1. Open the tool's domain authentication page.
  2. Publish the DKIM records it gives you under your own domain, so the signature uses d=yourdomain.com.
  3. If the tool supports a custom return-path domain, set that up too.
  4. Send a test to a Gmail address, open the message source and check that DKIM shows your domain and DMARC passes.

Check your domain

The free checker reads your live DNS and shows what is missing. The $29 Email Fix Pack writes the fix for your email provider and DNS host, with a rollback plan.

Check your domain free

Sources

More email delivery fixes