DEV Community

Mogley1011
Mogley1011

Posted on Originally published at email-fix-pack.pages.dev

DMARC fails even though SPF and DKIM pass: how alignment actually works

#security #email #dns #devops

You open the headers of a rejected or quarantined message and see something like this:

spf=pass smtp.mailfrom=bounce.vendor.com
dkim=pass header.d=vendor.com
dmarc=fail (p=quarantine) header.from=yourdomain.com
Enter fullscreen mode Exit fullscreen mode

SPF passed. DKIM passed. DMARC failed. That is not a bug, and it is one of the most common DMARC problems after a policy moves off p=none.

What DMARC really checks

DMARC does not ask "did SPF or DKIM pass?". It asks "did one of them pass for the same domain that appears in the visible From: header?" That match is called alignment.

  • SPF alignment: the domain in the envelope sender (smtp.mailfrom / Return-Path) must match the From: domain.
  • DKIM alignment: the d= domain in the DKIM signature must match the From: domain.

Only one of the two has to align. In the example above, both pass, but for vendor.com, not yourdomain.com. Neither aligns, so DMARC fails.

Relaxed vs strict

By default (aspf=r; adkim=r) alignment is relaxed: the organisational domain must match, so mail.yourdomain.com aligns with yourdomain.com. With aspf=s or adkim=s the domains must match exactly. If you set strict mode and a sender uses a subdomain, that sender starts failing.

The usual causes

  1. A third-party sender uses its own return-path and its own DKIM domain. Invoicing tools, CRMs, helpdesks and newsletter platforms do this by default. Fix: in the vendor's settings, enable "custom domain" / "domain authentication" so it signs with d=yourdomain.com (usually by adding CNAME or TXT records they give you) and, where offered, uses a custom return-path on your domain.
  2. A forwarder or mailing list rewrote the message. SPF breaks on forwarding because the forwarding server's IP is not in your record, and DKIM breaks if the body or subject is modified. This only matters when the original DKIM was aligned; it is why you want aligned DKIM, not just aligned SPF.
  3. DKIM selector missing or key rotated. The signature validates only if the public key at selector._domainkey.yourdomain.com still matches. After a rotation the old record can linger, or the new one never got published.

How to find which sender is failing

Do not guess from the policy. Read the DMARC aggregate reports (the rua= address in your record). Each row tells you the sending IP, the count, and the SPF/DKIM result and alignment for that source. Group by source: anything with a large count and fail is a sender you either need to configure or stop allowing.

Until every legitimate source shows aligned DKIM, stay at p=none or use pct= to ramp enforcement (p=quarantine; pct=10, then 25, 50, 100).

What to take from this

Alignment is not set once. New tools get added to a business over time, and each is a new place where passing authentication and passing DMARC come apart. Check the aggregate data on a schedule, not only after a delivery complaint.

If you would like to see how your own domain looks right now, Email Fix Pack has a free checker for live SPF, DKIM and DMARC (disclosure: I made it).

Top comments (0)