DMARC · Alignment

DMARC alignment failed: why DKIM/SPF passed but DMARC failed

22 October 2026

Authentication-Results can show spf=pass or dkim=pass while DMARC still fails. DMARC requires alignment: the domain in the visible From header must match (relaxed or strict) the domain that passed SPF or the DKIM d= domain. A pass on the wrong domain does not count.

Typical failure patterns

ESP signs DKIM as d=sendgrid.net (or similar) while From is brand.example—pass, not aligned.
SPF passes for the bounce / Mail-From domain that is not the organizational From domain under the alignment mode in use.
Forwarders break SPF; DKIM would have saved the message but the signature’s d= is not aligned either.
Subdomain From (mail.brand.example) with org-only DKIM d=brand.example can still align under relaxed mode—confirm adkim/aspf tags.

Fix path

Identify the exact From domain on a failing sample and run the static audit on it.
Enroll the ESP’s branded / authenticated domain so DKIM CNAMEs live under your domain and d= matches From (see transactional guide).
Prefer DKIM alignment for marketing and transactional streams; keep SPF for infrastructure you control.
Collect DMARC aggregate reports (Hosted DMARC or your own rua) and name every passing source before raising policy.
If headers show body-hash failures, fix signing order first—body hash guide.

Static audit cannot see a single message’s Authentication-Results. Paste a report in Account monitoring, or use the delivery probe on paid plans, to connect DNS to real send paths.