SPF passes but DMARC fails
Alignment is the requirement that a passing SPF or DKIM check belongs to the same domain a reader sees in the From: line. SPF checks the envelope sender and DKIM checks its own signing domain — neither is the visible address. When those differ, authentication passes and DMARC still fails.
Written by the SieveGuard team from the checks our own free tools run. Last reviewed .
Three domains in one message
Every message carries at least three domain names, and readers only ever see one of them. Alignment is the rule connecting the other two back to it.
| Domain | Where it lives | Who reads it | Checked by |
|---|---|---|---|
| Envelope sender | The SMTP MAIL FROM / Return-Path | Mail servers only | SPF |
| Signing domain | The d= tag in the DKIM signature | Mail servers only | DKIM |
| Header From | The From: header | The human | Neither — until DMARC |
That gap is the entire reason DMARC exists. Without it, a spoofer passes SPF for a domain they genuinely control while putting your domain in the visible From:. Both checks pass; the message is a forgery.
Why SPF passes and DMARC still fails
The single most common case, and it is not a misconfiguration:
Return-Path: bounces@mail.your-esp.com ← SPF checks THIS domain ✓ pass
From: hello@yourdomain.com ← the reader sees THIS
different domain → SPF NOT ALIGNED ✗Your ESP sets its own bounce domain so it can process bounces. SPF passes cleanly — for their domain. DMARC compares that to your From:, finds no relationship, and discards the SPF pass as unaligned.
Two fixes. Configure a custom return path at your ESP so the envelope becomes a subdomain of yours — most support this, often called custom bounce domain or custom MAIL FROM. Or rely on DKIM alignment instead, which you almost certainly already have, since the ESP signs with d=yourdomain.com. DMARC needs only one of the two to align.
Relaxed and strict
Both modes exist for both checks, and relaxed is the default for both. The difference is whether subdomains count.
| From: | Authenticated domain | Relaxed (default) | Strict |
|---|---|---|---|
| hello@yourdomain.com | yourdomain.com | Aligned | Aligned |
| hello@yourdomain.com | mail.yourdomain.com | Aligned | Not aligned |
| hello@mail.yourdomain.com | yourdomain.com | Aligned | Not aligned |
| hello@yourdomain.com | yourdomain.co | Not aligned | Not aligned |
| hello@yourdomain.com | your-esp.com | Not aligned | Not aligned |
Set strict mode with adkim=s and aspf=s. Almost nobody should: relaxed already blocks every cross-organisation forgery, and strict breaks the moment any legitimate sender uses a subdomain. Reach for it only if you have a specific reason to distrust your own subdomains.
Forwarding: the case where alignment saves you
A user sets up forwarding from an old address to a new one. The forwarder re-sends your message from its own IP.
original: your server ──────────────────► recipient SPF ✓ aligned DKIM ✓ aligned forwarded: your server ──► forwarder ──────► recipient SPF ✗ (wrong IP) DKIM ✓ aligned
SPF cannot survive this — the connecting IP is the forwarder’s and your record does not list it. Nothing is broken. But DMARC needs only one aligned pass, and the DKIM signature travelled inside the message untouched, so the message still passes DMARC.
This is the concrete reason to have both records right rather than one. A domain authenticating on SPF alone loses DMARC on every forwarded message. A domain with aligned DKIM does not.
Diagnosing your own reports
SPF pass, DKIM pass, DMARC fail
Neither passed for your domain. Check the ESP’s return path and the d= value it signs with — if d= is the ESP’s own domain, ask them to sign with yours. That is a settings change at their end, not a DNS change at yours.
One source fails, everything else passes
A single sending service is misconfigured. Almost always its DKIM key was rotated at the provider and the DNS record was never updated, or its include: was dropped from your SPF record.
Everything fails, from every source, at once
Not alignment. Look at SPF first — this is the signature of crossing the 10-lookup limit, where a permerror voids SPF everywhere simultaneously.
Failures from sources you do not recognise
Either genuine spoofing, or a forgotten internal sender. Resolve the IP before assuming the first — the invoicing system nobody documented looks exactly like an attacker in an aggregate report.
The rule, compressed
- DMARC passes if SPF aligns and passes, or DKIM aligns and passes.
- One is enough. Both is better, because they fail in different situations.
- Aligns means same organisational domain as the visible From: — subdomains count under relaxed.
- An unaligned pass is worth exactly as much as a failure. This is the part people miss.
Sources
FAQ
Why does DMARC fail when SPF passes?+
Because SPF checked a different domain from the one your reader sees. Most ESPs set their own bounce domain as the envelope sender, so SPF passes for the ESP while your From: header shows your domain. DMARC compares the two, finds no relationship, and treats the SPF pass as unaligned.
What is the difference between relaxed and strict alignment?+
Relaxed, the default, counts subdomains as aligned — mail.yourdomain.com aligns with yourdomain.com. Strict requires an exact match. Relaxed already stops every cross-organisation forgery, and strict breaks as soon as any legitimate sender uses a subdomain.
Do I need both SPF and DKIM to align?+
No, one is enough for DMARC to pass. Having both is still worth it because they fail in different circumstances: SPF breaks on forwarding, DKIM breaks when a mailing list rewrites the body. Cover both and one survives each case.
How do I make SPF align?+
Configure a custom return path at your sending provider so the envelope sender becomes a subdomain of your own domain. Most providers support this under a name like custom bounce domain or custom MAIL FROM. It is a setting at their end plus a DNS record at yours.
Does forwarding break DMARC?+
It breaks SPF, because the forwarder connects from its own IP. It does not break DKIM, because the signature travels inside the message. So a domain with aligned DKIM still passes DMARC on forwarded mail, and a domain relying on SPF alone does not.
What does an unaligned pass count for?+
Nothing, as far as DMARC is concerned. A passing SPF or DKIM check on a domain unrelated to your From: header is treated exactly like a failure. That is precisely the loophole DMARC was designed to close.
Check it on a real domain
Free, no signup, DNS-only. Nothing you type leaves the lookup.