DMARC Alignment Explained: Why SPF and DKIM Can Pass and Still Fail
DMARC alignment is the rule that says authentication only counts if it proves the same brand domain the recipient sees in From. An SPF or DKIM result can be a technical pass and still produce a DMARC fail when the authenticated domain does not align with the visible From domain.
That single idea explains most of the confusion teams hit after they publish DMARC: DNS “looks configured,” platforms show green ticks, and aggregate reports still show failures on legitimate mail.
If you already collect reports, pair this article with how to read DMARC aggregate reports. If you are still publishing the record, start with DMARC setup.
The two layers people mix up
| Layer | Question it answers | DMARC cares? |
|---|---|---|
| Authentication (SPF / DKIM) | Did some check pass for a domain on this message? | Necessary, not sufficient |
| Alignment | Was that pass for the From domain (or an allowed parent under your mode)? | Required for a DMARC pass |
DMARC does not treat “any SPF pass anywhere” as brand proof. It asks: did SPF and/or DKIM pass in a way that matches the identity the user sees?
For a message to satisfy DMARC, at least one of these must be true:
- SPF passes and is aligned, or
- DKIM passes and is aligned
One aligned pass is enough. Two unaligned passes are not.
What “aligned” means in practice
The Header From domain is the brand identity DMARC evaluates (the domain after @ in the visible From address).
SPF alignment
SPF authenticates the MAIL FROM / bounce (Return-Path) domain — often a platform bounce domain, not the marketing From.
- Aligned SPF: the SPF-authenticated domain is the same as Header From, or an allowed organisational parent under your alignment mode.
- Unaligned SPF pass: the ESP’s bounce domain passes SPF for them, while From still says
you.co.za. That is common and not a DMARC pass by itself.
DKIM alignment
DKIM authenticates the domain in the signature’s d= tag.
- Aligned DKIM:
d=matches Header From (or parent, under relaxed mode). - Unaligned DKIM pass: the platform signs with
d=vendor.examplewhile From is your brand. Signature validates; DMARC still fails unless something else aligns.
Operational rule of thumb: for brand-aligned bulk and transactional mail, you usually want DKIM signing as your From domain (or a deliberate subdomain strategy), not only a vendor-domain signature.
Relaxed vs strict (aspf / adkim)
DMARC alignment modes control whether a parent organisation domain can cover a subdomain From (and vice versa in the ways the standard allows).
| Mode | Tag | Typical effect |
|---|---|---|
| Relaxed (default) | aspf=r / adkim=r (or omitted) |
news.brand.co.za can align with organisational domain brand.co.za when the authenticated domain is that org domain (and the other way around in the usual parent/child cases teams rely on). |
| Strict | aspf=s / adkim=s |
Header From and authenticated domain must match exactly — subdomain From will not ride on apex auth. |
Defaults are relaxed for a reason: multi-subdomain estates break quickly under strict alignment before inventory is clean. Move to strict only when you intend exact-domain binding and have verified every stream.
Do not flip adkim=s / aspf=s as a “security win” without reading a week of reports. Strict mode is a precision tool, not a shortcut past sender hygiene.
Why reports say “SPF pass, DMARC fail”
This is the classic ESP row:
- From:
invoices@brand.co.za - Bounce / MAIL FROM: something like
bounces.esp-platform.net - SPF pass for the ESP bounce domain
- DKIM either missing, failing, or
d=on the ESP domain - DMARC fail — nothing aligned to
brand.co.za
Nothing is “broken” in SPF. The missing piece is brand-domain proof.
Common legitimate causes
- New SaaS “connected domain” but only verified a CNAME for the vendor, not brand DKIM
- Marketing platform signing with vendor
d=while From is corporate - Forwarders and lists rewriting paths so SPF no longer matches (see ARC and forwarded mail)
- Shared or legacy bounce domains after a provider migration
- Subdomain From with strict alignment still pointed at apex-only auth
Causes that look technical but are governance
- Nobody owns “who may send as this From”
- IT published SPF includes without confirming DKIM on the live stream
- Marketing launched a tool the day before a campaign (use the SaaS sender onboarding checklist)
How to fix alignment without breaking mail
Work highest volume first. One aligned stream at a time beats a DNS rewrite festival.
1. Label the row
For each high-count source in aggregate reports:
- known platform / unknown / suspicious
- SPF result and SPF domain
- DKIM result and DKIM
d=domain - Header From domain
If SPF and DKIM both pass but both domains are the vendor, you have an alignment project, not an SPF syntax project.
2. Prefer aligned DKIM for the brand From
With most modern ESPs and SaaS tools:
- Complete domain authentication so they sign with
d=equal to your From domain (or the intentional subdomain). - Confirm signatures on a real test message (headers), not only a dashboard green light.
- Watch the next report window for that source flipping to aligned DKIM pass.
SPF still matters for other reasons (and can contribute an aligned pass when MAIL FROM is under your domain), but DKIM alignment is usually the durable fix for third-party senders.
3. Keep SPF honest; do not “fix” alignment with random includes
Stuffing more include: mechanisms to chase green SPF often creates permerror / 10-lookup failures. Alignment is not fixed by an extra include if MAIL FROM stays on the vendor domain.
4. Decide subdomain policy deliberately
Many teams send campaigns from news. or mail. while staff mail stays on the apex. That can be healthy if:
- DMARC (and usually DKIM) is correct for that subdomain identity
- you understand
sp=(subdomain policy) on the organisational record - marketing and IT agree which From domains are allowed
Alignment problems multiply when every tool uses a different From subdomain with no inventory.
5. Only then raise policy
Unaligned legitimate volume is why estates stay on p=none forever. Fix alignment on the important sources, then follow the path from monitoring to reject. Monitoring alone is not protection.
Quick checklist for a single sending platform
Use this before the first production send (or the next campaign):
- Exact From domain (apex vs subdomain) agreed in writing
- DKIM enabled for that domain; sample message shows
d=aligned - SPF includes only what you still need; no permerror
- Test addresses at major receivers receive the message
- Next aggregate window: that source shows aligned pass volume
- Owner named for DNS changes when the vendor rotates selectors
If step 2 fails, do not schedule volume. Alignment debt is cheapest before launch.
What leaders should ask
Replace “Is DMARC on?” with:
- What share of volume is known and aligned?
- Which platforms still pass SPF/DKIM only on vendor domains?
- Are we on relaxed or strict alignment on purpose?
- When is the next policy step after the top sources align?
Those questions map cleanly to report data and avoid false confidence from a published TXT record alone.
Final takeaway
Authentication without alignment is not DMARC success. Green SPF or DKIM on a vendor domain does not prove the brand From. Teach your team to read which domain passed, not only pass/fail, then repair the highest-volume legitimate sources with aligned DKIM (and clean SPF) before you enforce.
Next step: run a free domain check for public SPF/DKIM/DMARC posture, confirm reports are flowing, and use your next aggregate window to list every high-volume source that still fails alignment — those rows are your real enforcement backlog.