SPF, DKIM and DMARC alignment
Authentication alone is not enough. DMARC requires that the domain authenticated by SPF or DKIM matches the domain in the From header the recipient sees.
The concept
Authentication is not enough without alignment.
SPF and DKIM can both pass and still fail DMARC. That happens when the domain that passed authentication does not match the domain in the From header. DMARC calls this misalignment, and it is the most common reason for unexpected failures.
SPF alignment
SPF authenticates the envelope sender (Return-Path). For DMARC to pass via SPF, the envelope domain must match the From header domain. In relaxed mode (the default), the organizational domains must match. In strict mode, the exact domains must match.
DKIM alignment
DKIM authenticates the signing domain (the d=
tag). For DMARC to pass via DKIM, the signing domain must
align with the From header domain. Most ESPs sign with
their own domain by default, which fails alignment until
you configure a custom signing domain.
Common scenarios
- SaaS sending via an ESPSPF passes for the ESP envelope domain but fails alignment because the From is your domain. Fix: set up DKIM signing with your own domain.
- ForwardingA forwarder changes the envelope but not the From, breaking SPF alignment. DKIM survives forwarding as long as the body is unchanged.
- Mailing listsLists that rewrite the From header break DKIM alignment. Lists that keep the From but change the envelope break SPF alignment. ARC is the emerging fix.
What can go wrong
Related findings.
| Finding | What it means |
|---|---|
dkim_alignment_fail
|
DKIM alignment failure |
dmarc_partial_coverage
|
DMARC partial coverage |
More guides
Keep reading.
How SPF works
SPF declares which servers may send mail for a domain. A TXT record in DNS lists IP addresses and includes, and a receiver evaluates them in order.
How DKIM works
DKIM attaches a cryptographic signature to each message. The receiver fetches the public key from DNS and verifies that the message was not altered after signing.
How DMARC works
DMARC ties SPF and DKIM together by requiring that at least one of them aligns with the From header domain. It tells receivers what to do when neither does.
DKIM selectors explained
A selector is the label that tells the receiver which public key to fetch from DNS. Different services use different selectors, and rotating them is how you change keys without downtime.
The SPF 10-lookup limit
Every include, a, mx, ptr and exists mechanism in an SPF record costs one DNS lookup. The specification caps the total at ten, and exceeding it is a permanent error.
DMARC aggregate reports
Aggregate reports are XML files that receiving domains send to the address in your rua tag. They show who is sending mail as your domain, and whether it passes or fails.