Emails Failing DMARC Alignment: Diagnosis and Solutions

Introduction

SPF passes. DKIM passes. But DMARC still fails. This frustrating scenario happens when your emails fail "alignment"—a critical DMARC requirement that many people misunderstand.

This guide explains what DMARC alignment is, why it fails, and how to fix it.

Understanding DMARC Alignment

What is Alignment?

DMARC alignment means the domain in the visible "From" header matches the domain that passed SPF or DKIM authentication.

DMARC requires at least one of these to align:

• SPF alignment: "From" domain matches SPF-authenticated domain
• DKIM alignment: "From" domain matches DKIM signature domain

Key insight: SPF and DKIM can both pass, but if neither aligns with the "From" domain, DMARC fails.

The Three Email Domains

Understanding alignment requires knowing three different email domains:

1. Header From (Visible "From")

• What recipients see: user@yourdomain.com
• Set by email client or application
• This is what must align

2. Envelope From (Return-Path, MAIL FROM)

• Used by SPF
• Often different from Header From
• Invisible to recipients

3. DKIM Signing Domain

• Domain in DKIM signature d= tag
• May differ from Header From
• Invisible to recipients

Example showing all three:

Header From: user@yourdomain.com
Envelope From: bounce@mailservice.com
DKIM d= tag: mailservice.com

Result: No alignment → DMARC fails

Types of Alignment

Relaxed Alignment (Default)

Organizational domains must match:

• yourdomain.com aligns with mail.yourdomain.com ✅
• yourdomain.com aligns with sub.yourdomain.com ✅
• yourdomain.com does NOT align with otherdomain.com ❌

DMARC tag: adkim=r (DKIM) and aspf=r (SPF)

Example:

Header From: user@yourdomain.com
DKIM d=mail.yourdomain.com
→ Relaxed alignment PASSES ✅

Strict Alignment

Domains must match exactly:

• yourdomain.com aligns with yourdomain.com ✅
• yourdomain.com does NOT align with mail.yourdomain.com ❌
• yourdomain.com does NOT align with sub.yourdomain.com ❌

DMARC tag: adkim=s (DKIM) and aspf=s (SPF)

Example:

Header From: user@yourdomain.com
DKIM d=mail.yourdomain.com
→ Strict alignment FAILS ❌

Recommendation: Use relaxed alignment unless you have specific security requirements.

Common Alignment Failure Scenarios

Scenario 1: Third-Party Email Service Not Aligned

Problem: Using email service that sends from their domain

Example:

Header From: support@yourdomain.com
Envelope From: bounce@emailservice.com
DKIM d=emailservice.com

SPF: Passes for emailservice.com
DKIM: Passes for emailservice.com
DMARC Alignment: FAILS ❌ (neither aligns with yourdomain.com)

Solution: Configure Custom Domain Sending

Most email services support custom domain sending:

For marketing platforms (Mailchimp, SendGrid, etc.):

1. Add and verify your domain in platform settings
2. Configure custom "From" domain
3. Add provided DNS records (SPF include, DKIM records)
4. Enable domain authentication

For support systems (Zendesk, Freshdesk):

1. Configure custom support address
2. Add DNS records for authentication
3. Enable domain forwarding

For transactional email (SendGrid, Mailgun, SES):

1. Verify domain ownership
2. Add SPF include to your domain
3. Configure DKIM signing for your domain
4. Set "From" domain to yours in API calls

Scenario 2: Email Forwarding Breaks Alignment

Problem: Forwarded emails fail DMARC

Example:

Original:
  Header From: sender@company.com
  DKIM: Passes for company.com
  → Delivers to user@gmail.com

Gmail forwards to:
  user@work.com

At work.com:
  SPF: Checks Gmail's servers (not company.com's) → FAILS
  DKIM: Usually preserved → PASSES
  DMARC: If SPF alignment required → FAILS

Why it happens:

When email is forwarded:

• Envelope From changes to forwarder's domain
• SPF checks forwarder's servers (not original)
• DKIM usually survives (unless content modified)

Solution: Use SRS (Sender Rewriting Scheme)

For server administrators:

• Implement SRS on forwarding servers
• Rewrites envelope sender to maintain SPF
• Preserves DMARC compliance

For users:

• Use native forwarding features (Gmail, Outlook)
• Avoid simple .forward files
• Accept some forwarded emails may fail strict policies

Alternative: Configure catching address instead of forwarding

• Use POP3/IMAP to check multiple accounts
• Email client consolidation
• Avoids forwarding issues entirely

Scenario 3: Subdomain Sending Without Proper Setup

Problem: Sending from subdomain but DMARC on root domain

Example:

Header From: orders@shop.yourdomain.com
SPF/DKIM: Authenticated for shop.yourdomain.com
DMARC: Only on yourdomain.com (not shop.yourdomain.com)

Result: No DMARC policy for subdomain

Solution:

Option 1: Add DMARC to subdomain

_dmarc.shop.yourdomain.com TXT "v=DMARC1; p=quarantine; rua=mailto:dmarc@yourdomain.com"

Option 2: Use subdomain policy in root DMARC

_dmarc.yourdomain.com TXT "v=DMARC1; p=reject; sp=quarantine; rua=mailto:dmarc@yourdomain.com"

• p=reject: Policy for root domain
• sp=quarantine: Policy for all subdomains

Option 3: Use relaxed alignment

If subdomains use same organizational domain, relaxed alignment works:

v=DMARC1; p=quarantine; adkim=r; aspf=r; rua=mailto:dmarc@yourdomain.com

Scenario 4: Mailing Lists Breaking Alignment

Problem: List software modifies "From" header

Example:

Original email:
  From: user@company.com
  
After mailing list processing:
  From: user@company.com via ListName <list@mailinglist.com>
  
DMARC: "From" now includes list domain → alignment may fail

Why it happens:

Mailing lists often:

• Rewrite "From" header
• Add list name to sender
• Change envelope sender to list server

Solution:

For list administrators:

Option 1: DMARC-friendly rewriting

• Rewrite "From" to list address
• Add original sender to "Reply-To"

From: list@mailinglist.com
Reply-To: user@company.com

Option 2: Don't modify "From" header

• Keep original "From" intact
• Add list info to footer only

For list subscribers:

• Accept some list emails may fail with strict policies
• Use relaxed DMARC alignment
• Whitelist known mailing lists

Scenario 5: Using Email Aliases

Problem: Sending from alias that doesn't match authenticated domain

Example:

Authenticated domain: company.com
Sending as: team@brand.com (alias)

SPF/DKIM: Pass for company.com
Header From: team@brand.com
DMARC: Alignment FAILS (brand.com ≠ company.com)

Solution:

Option 1: Authenticate alias domain

• Add SPF, DKIM, DMARC for brand.com
• Configure email service to sign for brand.com

Option 2: Use subdomain of main domain

• Instead of: team@brand.com
• Use: brand@company.com or team.brand@company.com
• Maintains alignment with relaxed mode

Option 3: Send from main domain

• From: team@company.com
• Display name: "Brand Team"

Diagnosing Alignment Failures

Check Email Headers

Send test email, view original headers, find:

Authentication-Results: mx.google.com;
       spf=pass smtp.mailfrom=bounce.emailservice.com;
       dkim=pass header.i=@emailservice.com header.s=mail;
       dmarc=fail (p=QUARANTINE dis=none) header.from=yourdomain.com

Key indicators:

• smtp.mailfrom=: Envelope From (SPF domain)
• header.i=: DKIM signing domain
• header.from=: Visible From (must align with one of above)

Use DMARC Reports

DMARC aggregate reports show alignment details:

Look for:

<row>
  <source_ip>192.0.2.1</source_ip>
  <count>100</count>
  <policy_evaluated>
    <disposition>quarantine</disposition>
    <dkim>fail</dkim>
    <spf>fail</spf>
  </policy_evaluated>
</row>
<auth_results>
  <dkim>
    <domain>emailservice.com</domain>
    <result>pass</result>
  </dkim>
  <spf>
    <domain>emailservice.com</domain>
    <result>pass</result>
  </spf>
</auth_results>
<identifiers>
  <header_from>yourdomain.com</header_from>
</identifiers>

This shows:

• DKIM passed for emailservice.com
• SPF passed for emailservice.com
• "From" header was yourdomain.com
• Neither aligned → DMARC failed

Get automated analysis: DMARC Reports →

Use Testing Tools

Our Domain Score: Check Domain Alignment →

Manual header check:

1. Send test email to Gmail
2. Show original message
3. Search for "Authentication-Results"
4. Review alignment details

Fixing Alignment Issues

Step 1: Identify Source

From DMARC reports or headers, identify:

• Which emails are failing
• What "From" domain they use
• What domain SPF/DKIM authenticated

Step 2: Verify Configuration

For authenticated domain:

• SPF includes sending service
• DKIM configured for your domain
• "From" domain matches your domain

Step 3: Choose Fix Strategy

If using third-party service: → Configure custom domain sending

If forwarding emails: → Implement SRS or use native forwarding

If using subdomain: → Add subdomain DMARC or use sp= tag

If using aliases: → Authenticate alias domain separately

Step 4: Update DMARC Policy

Use relaxed alignment:

v=DMARC1; p=quarantine; adkim=r; aspf=r; rua=mailto:dmarc@yourdomain.com

• adkim=r: Relaxed DKIM alignment
• aspf=r: Relaxed SPF alignment

Or strict (if you have control):

v=DMARC1; p=quarantine; adkim=s; aspf=s; rua=mailto:dmarc@yourdomain.com

Step 5: Test Thoroughly

1. Send test emails from each source
2. Verify headers show alignment pass
3. Check DMARC reports after 24-48 hours
4. Monitor for unexpected failures

Alignment Best Practices

✅ Use relaxed alignment

• More forgiving
• Handles subdomains
• Default for most organizations

✅ Configure third-party senders properly

• Add your domain to their platform
• Complete domain verification
• Test before production use

✅ Monitor DMARC reports

• Weekly review
• Identify new failures quickly
• Automated monitoring →

✅ Document your email sources

• List all services sending from your domain
• Note authentication configuration
• Update when adding new services

✅ Test before enforcing

• Start with p=none (monitoring)
• Review reports for 2-4 weeks
• Fix alignment issues
• Then move to p=quarantine or p=reject

The Bottom Line

DMARC alignment failures occur when:

The visible "From" domain doesn't match the SPF or DKIM authenticated domain.

Most common causes:

1. Third-party services sending from their domain
2. Email forwarding
3. Subdomain configuration issues
4. Alias domains not authenticated

Quick fix:

1. Identify which emails are failing alignment
2. Configure custom domain sending in email service
3. Use relaxed alignment: adkim=r; aspf=r
4. Test and monitor

Timeline:

• Diagnosis: 15 minutes
• Configure custom sending: 30 minutes
• DNS propagation: 30-60 minutes
• Verification: 24-48 hours of monitoring

Next Steps

1. Check alignment status: DMARC Checker →
2. Review DMARC reports: Sign up for analysis →
3. Verify complete auth: Domain Score →

---

Related Articles:

• SPF, DKIM, and DMARC: The Complete Guide
• DMARC Policy Explained: None vs Quarantine vs Reject
• Why Your Emails Are Going to Spam