AuthenticationDeliverability

DMARC Fails Even Though SPF and DKIM Pass? It's an Alignment Problem

Nestmarketing Team · · 2 min read

You open the headers and see this:

spf=pass  smtp.mailfrom=bounce.sendingtool.com
dkim=pass header.d=sendingtool.com
dmarc=fail header.from=yourbrand.com

Two passes and a fail. It looks like a bug. It isn't.

What DMARC actually checks

DMARC doesn't only ask "did SPF pass?" or "did DKIM pass?". It asks:

Did SPF or DKIM pass for the same domain the reader sees in the From line?

That "same domain" requirement is called alignment.

In the example above:

  • SPF passed for bounce.sendingtool.com, which is the sending tool's domain, not yours.
  • DKIM passed for sendingtool.com, again not yours.
  • The From address says yourbrand.com.

Nothing passed for yourbrand.com, so DMARC fails.

Where the domains come from

  • SPF checks the envelope sender, also called Return-Path or MAIL FROM. Recipients never see it. Many tools set it to their own domain by default.
  • DKIM checks the domain in the signature's d= tag. Tools sign with their own domain unless you set up custom DKIM.
  • From is the address shown in the inbox.

The fix

You only need one of the two to align, but we always set up both.

Align DKIM (most important)

In your sending tool, look for "custom domain authentication", "branded sending domain" or "DKIM for your domain". It will give you CNAME or TXT records to add to your DNS. After that, emails are signed with d=yourbrand.com and DKIM aligns.

DKIM alignment is the sturdier of the two because it survives forwarding. SPF breaks when an email is forwarded.

Align SPF

Set a custom Return-Path such as bounce.yourbrand.com. The tool will ask you to add a CNAME and include its servers in that subdomain's SPF. Under relaxed alignment, which is the default, bounce.yourbrand.com aligns with yourbrand.com.

Relaxed vs strict

Your DMARC record can include adkim= and aspf=:

  • r (relaxed, default): subdomains count as a match
  • s (strict): the domains must match exactly

Leave both on relaxed unless you have a specific reason. Strict alignment breaks a lot of legitimate setups.

Check it worked

Send a test to Gmail, open Show original, and look for:

dkim=pass header.d=yourbrand.com
dmarc=pass

Then read your DMARC aggregate reports for a week before moving your policy from p=none to p=quarantine. The reports show every service sending as your domain, including ones you forgot about.

Why this matters more now

Since the Gmail, Yahoo and Microsoft sender rules, alignment is a requirement for bulk senders, not a nice-to-have. Unaligned mail is far more likely to end up in spam or be rejected outright.

Our authentication setup guide covers the full DNS side, and every cold email infrastructure we build ships with aligned SPF and DKIM on every domain.

Related articles