DMARC alignment troubleshooting: find why SPF or DKIM passes but DMARC fails

Read Authentication-Results and message identities

Record the header From domain, envelope MAIL FROM/Return-Path domain, DKIM d= domain, selector, and the receiver’s SPF/DKIM/DMARC results. Do not infer alignment from a green “SPF pass” badge alone.

Forwarding can break SPF while leaving a valid aligned DKIM signature intact, which is one reason DMARC accepts either aligned method.

Check relaxed versus strict alignment

Relaxed alignment can allow organizational-domain relationships such as mail.example.com aligning with example.com; strict alignment requires a closer match. Verify the domain’s DMARC aspf and adkim settings before diagnosing a subdomain difference.

Different providers may use a custom bounce domain to create SPF alignment.

Fix the sender configuration, not the report

Configure the legitimate sending platform to sign DKIM with your domain or use an aligned return path where supported. Publishing broader SPF does not align an unrelated MAIL FROM domain.

For third-party senders, follow their verified-domain instructions and publish only the DKIM records they provide.

Retest all legitimate sources before enforcement

Deliver external samples from mailbox hosting, websites, CRM, support, billing, and marketing systems. Move toward quarantine/reject only after expected mail consistently aligns.

• Start from the visible From domain.
• Inspect SPF MAIL FROM and DKIM d=.
• Check strict/relaxed policy.
• Fix each sender before enforcement.