How can SPF and DKIM both pass but DMARC still fail?

SPF and DKIM each check whether a message is authorized by a specific domain — but not necessarily the domain your recipient sees in the From address. DMARC adds a third check on top: does the authorized domain actually match (or align with) the visible From domain? A message can be legitimately signed and authorized by one domain while displaying a completely different From address, passing SPF and DKIM individually while failing DMARC's alignment check.

What is the difference between relaxed and strict alignment?

Relaxed alignment (the default) accepts a match at the organizational domain level — mail.yourdomain.com aligns with yourdomain.com. Strict alignment requires an exact match between the authenticated domain and the From domain, with no subdomain flexibility at all.

Does SPF alignment work differently from DKIM alignment?

Yes. SPF alignment compares the From domain against the Return-Path (envelope sender) domain. DKIM alignment compares the From domain against the d= domain in the DKIM signature. A message only needs one of the two to align for DMARC to pass overall — but if you're relying on just one, a single misconfiguration removes your only path to passing.

Why does forwarded mail so often fail DMARC alignment?

When a message is forwarded, the forwarding server typically keeps the original DKIM signature intact (so DKIM can still pass and align) but changes the envelope sender to its own domain (so SPF fails or no longer aligns). This is precisely why DMARC only requires one of the two mechanisms to align rather than both — a design decision meant to tolerate exactly this kind of forwarding.

DMARC Alignment Failure: Why SPF and DKIM Can Both Pass and DMARC Still Fails

Every DMARC report has messages that show spf=pass, dkim=pass, and dmarc=fail on the same line. That’s not a bug in the report — it’s alignment, the one part of DMARC most explanations skip past. This is what it actually checks, why it fails even when the underlying auth is fine, and the specific fix.

Run a free audit → — paste your email headers and see every failing check, with the fix for each. No account.

What SPF and DKIM Actually Check (and What They Don’t)

SPF checks whether the sending server’s IP is authorized for the Return-Path domain — the invisible envelope sender, not what a recipient sees in their inbox.

DKIM checks whether a message’s cryptographic signature is valid for the d= domain named in the signature header — a domain the signing server chose, which also isn’t necessarily what’s shown in the From address.

Neither one checks the domain in the visible From header at all. That’s the gap DMARC exists to close.

What Alignment Actually Means

DMARC takes the domain that SPF or DKIM already authenticated and asks one more question: does it match the domain in the From header a recipient actually sees?

If it does, that mechanism is aligned, and DMARC passes on the strength of it. If neither SPF’s Return-Path domain nor DKIM’s d= domain matches the From domain, DMARC fails — even though the individual SPF and DKIM checks came back clean.

This is exactly how spoofing worked before DMARC existed: send a message that’s perfectly SPF- and DKIM-valid for attacker-domain.com, but set the visible From address to yourbank.com. Without alignment, that message sails through. DMARC’s entire purpose is closing this specific gap.

Relaxed vs. Strict Alignment

Alignment mode controls how exact the match needs to be, set independently for each mechanism via aspf (SPF alignment) and adkim (DKIM alignment) in your DMARC record:

Relaxed (the default when unspecified) matches at the organizational domain level. mail.yourdomain.com and newsletter.yourdomain.com both align with yourdomain.com.

Strict requires an exact match, character for character. mail.yourdomain.com does not align with yourdomain.com under strict mode — that’s a fail.

Most senders should stay on relaxed unless there’s a specific reason to tighten it — strict mode breaks alignment the moment any subdomain sends mail, including ones you may not think of as “sending domains” (a marketing platform configured under a subdomain, for instance).

Why This Fails More Often Than People Expect

A subdomain sends mail under strict alignment. The most common self-inflicted case — an ESP or internal tool sends from mail.yourdomain.com, alignment is set to strict, and every one of those messages fails DMARC even though SPF and DKIM are both individually configured correctly.

The Return-Path domain differs from the visible From domain. Some ESPs sign with their own Return-Path domain by default rather than yours, meaning SPF authenticates their domain, not yours — automatically misaligned regardless of relaxed/strict settings unless you’ve set up a custom Return-Path.

DKIM is signed under the wrong domain. If an ESP’s default DKIM setup signs with d=espdomain.com instead of your own domain via a custom DKIM setup (sometimes called “domain alignment” or “branded DKIM” in ESP documentation), DKIM alignment fails structurally, independent of whether the signature itself is valid.

Mail gets forwarded. A forwarding server usually preserves the original DKIM signature (so DKIM can still align) but rewrites the envelope sender to its own domain (so SPF no longer aligns). One aligned mechanism is enough for DMARC to pass — which is exactly why DMARC only requires one, not both.

How to Fix It

Check your DMARC aggregate reports for lines showing dmarc=fail alongside spf=pass/dkim=pass — that combination specifically points to alignment, not a broken auth record.
Confirm which domain each ESP actually authenticates. Check whether your ESP’s default Return-Path and DKIM signing domain use your domain or theirs — most ESPs support switching to a custom/branded setup, but it’s rarely the default.
Match your alignment mode to your actual sending setup. If subdomains legitimately send mail on your behalf, relaxed alignment is almost certainly the right choice — the DMARC Record Generator sets this explicitly rather than leaving it as an unstated default.
Re-check reports after the fix, not just the record. Alignment fixes take effect only on new outgoing mail — existing reports in the pipeline still reflect the old configuration for a few days.

Frequently Asked Questions

How can SPF and DKIM both pass but DMARC still fail?: SPF and DKIM each check whether a message is authorized by a specific domain — but not necessarily the domain your recipient sees in the From address. DMARC adds a third check on top: does the authorized domain actually match (or align with) the visible From domain? A message can be legitimately signed and authorized by one domain while displaying a completely different From address, passing SPF and DKIM individually while failing DMARC’s alignment check.
What is the difference between relaxed and strict alignment?: Relaxed alignment (the default) accepts a match at the organizational domain level — mail.yourdomain.com aligns with yourdomain.com. Strict alignment requires an exact match between the authenticated domain and the From domain, with no subdomain flexibility at all.
Does SPF alignment work differently from DKIM alignment?: Yes. SPF alignment compares the From domain against the Return-Path (envelope sender) domain. DKIM alignment compares the From domain against the d= domain in the DKIM signature. A message only needs one of the two to align for DMARC to pass overall — but if you’re relying on just one, a single misconfiguration removes your only path to passing.
Why does forwarded mail so often fail DMARC alignment?: When a message is forwarded, the forwarding server typically keeps the original DKIM signature intact (so DKIM can still pass and align) but changes the envelope sender to its own domain (so SPF fails or no longer aligns). This is precisely why DMARC only requires one of the two mechanisms to align rather than both — a design decision meant to tolerate exactly this kind of forwarding.