DMARC Alignment Explained: Why SPF and DKIM Pass but DMARC Fails
SPF and DKIM can both pass while DMARC still fails, because DMARC asks a different question: do the authenticated domains match the From address your recipient sees?
DMARC fails when SPF and DKIM pass for a domain that is not the one in the visible From address. SPF checks the envelope sender (Return-Path) and DKIM checks the signing domain (d=). DMARC only counts a pass if at least one of those domains aligns with the header From. Third-party platforms using their own domains are the usual cause.
The three domains hiding in every email
Most people think an email has one sender. Technically it has at least three domain identities, and they do not have to agree with one another.
- The header From (RFC5322.From). This is the address your recipient sees in their mail client, for example
accounts@yourcompany.co.za. It is the identity people trust, and it is the one attackers forge. - The envelope sender (RFC5321.MailFrom, visible afterwards as the Return-Path header). This is where bounces go. SPF authenticates this domain, not the header From.
- The DKIM signing domain, shown as the
d=tag in the DKIM-Signature header. DKIM proves that this domain signed the message and that the signed parts were not altered.
SPF and DKIM were designed before DMARC existed, and neither of them looks at the header From at all. That is the gap attackers used for years: they could send from their own infrastructure, pass SPF for their own envelope domain, and still put your name in the From line. DMARC closes the gap by adding one requirement, alignment.
What alignment actually checks
A message passes DMARC if at least one of the following is true:
- SPF passes and the envelope sender domain aligns with the header From domain; or
- DKIM passes and the
d=signing domain aligns with the header From domain.
Both do not need to align. One aligned pass is enough. That is why aggregate reports can show SPF “pass” and DKIM “pass” next to a DMARC result of “fail”: the raw checks succeeded, but for domains belonging to someone else. Reading those report rows correctly is covered in how to read a DMARC report.
It also explains why DKIM matters so much in practice. SPF usually fails or stops aligning when mail is forwarded, because the forwarding server becomes the connecting IP. A valid DKIM signature usually survives forwarding as long as the message is not modified. A sender with aligned DKIM is therefore far more resilient than one relying on aligned SPF alone.
Relaxed versus strict alignment
DMARC lets you choose how close the match must be, separately for SPF (aspf) and DKIM (adkim). The default for both is relaxed.
| Mode | Tag value | Rule | Example that passes |
|---|---|---|---|
| Relaxed (default) | aspf=r, adkim=r | Same organisational domain | From yourcompany.co.za, DKIM d=news.yourcompany.co.za |
| Strict | aspf=s, adkim=s | Exact domain match | From yourcompany.co.za, DKIM d=yourcompany.co.za only |
The organisational domain is the registrable domain, determined using the Public Suffix List. For mail.yourcompany.co.za it is yourcompany.co.za, because co.za is a public suffix. Relaxed alignment is what lets you put a newsletter platform on news.yourcompany.co.za and still align with mail sent from the root domain.
Strict alignment has a narrow use: organisations that want to stop a subdomain, perhaps operated by a third party, from being able to authenticate mail on behalf of the parent. For most South African businesses, strict mode adds breakage risk and very little protection. Leave it relaxed unless you have a specific reason.
Worked examples
These examples use generic platform types rather than specific vendors, because each vendor’s configuration changes over time. The patterns are what matter.
Example 1: the newsletter platform with default settings
Your marketing team sends a newsletter from hello@yourcompany.co.za using an email marketing platform, with no domain authentication set up.
- Envelope sender: a bounce address on the platform’s own domain. SPF passes, for the platform’s domain.
- DKIM: signed with the platform’s shared domain. DKIM passes, for the platform’s domain.
- Header From:
yourcompany.co.za.
Result: SPF pass, DKIM pass, DMARC fail. Neither authenticated domain aligns. At p=none nothing visible happens. At p=reject, your newsletter disappears.
Example 2: the cloud accounting platform sending invoices
Your accounting system emails invoices to clients with your address in the From line. Many such platforms send from their own infrastructure by default, and some offer an option to authenticate your domain. Until that is set up, the pattern is identical to Example 1. This is the one that hurts most, because invoices are exactly the mail you need to land. It is also exactly the mail fraudsters imitate, as discussed in how spoofing leads to invoice fraud.
Example 3: the same platform after custom DKIM
You publish the DKIM records the platform supplies, typically CNAME or TXT records under selector._domainkey.yourcompany.co.za, and switch on domain authentication in the platform.
- Envelope sender: still the platform’s domain. SPF passes, does not align.
- DKIM:
d=yourcompany.co.za. DKIM passes and aligns.
Result: DMARC pass. One aligned mechanism is enough, and it is the robust one.
Example 4: forwarding
A client forwards your invoice to their accounts department through a server that does not modify the message. SPF now evaluates the forwarder’s IP against your SPF record and fails. Your aligned DKIM signature is still valid, so DMARC still passes. If you had relied on SPF alone, it would fail.
Example 5: the website contact form
Your website sends enquiry notifications “from” info@yourcompany.co.za using the web server’s default mail function. The envelope sender is often the hosting server’s own hostname, and there is usually no DKIM signature for your domain at all. SPF passes or fails for the wrong domain, DKIM is absent, and DMARC fails. The fix is to send through an authenticated SMTP account on your mail platform, or through a transactional service with custom DKIM, rather than the server’s local mail function.
How to fix misaligned senders
There are two levers, and you should pull the DKIM lever first.
Custom DKIM (preferred)
Most reputable sending platforms support signing with your own domain. The setup involves publishing records the vendor gives you, then confirming in the vendor’s dashboard. Publish them exactly as shown: the selector name and target are vendor-specific, and a typo simply means “selector not found”. Our guide to DKIM covers selectors and key length.
Custom return-path (useful second layer)
Some platforms let you set the envelope sender to a subdomain you control, for example bounce.yourcompany.co.za, usually by publishing a CNAME that points to the vendor. Under relaxed alignment, that subdomain aligns with yourcompany.co.za, so SPF now provides an aligned pass as well. This also keeps the vendor’s include out of your root SPF record, which helps with the 10-lookup limit.
When the vendor supports neither
You have three honest options: send from a subdomain the vendor can authenticate, route the mail through your own platform (for example via SMTP relay through your mailbox provider), or change vendor. What you should not do is leave a business-critical sender unaligned and hope it survives enforcement. It will not.
Questions to put to any vendor
- Can you sign DKIM with our domain, and what records do we publish?
- Can we set a custom return-path or bounce domain?
- Do you send from shared or dedicated infrastructure?
- Will the configuration survive account changes, plan changes or re-verification?
A diagnosis table for report rows
When you look at a source in your aggregate data, this table tells you what is going on and what to do next.
| SPF | DKIM | DMARC | Likely meaning | Action |
|---|---|---|---|---|
| Pass, aligned | Pass, aligned | Pass | Fully configured sender | None; keep monitoring |
| Pass, not aligned | Pass, aligned | Pass | Third party with custom DKIM | Optional custom return-path |
| Pass, not aligned | Pass, not aligned | Fail | Legitimate platform, unauthenticated | Set up custom DKIM before enforcing |
| Fail | Pass, aligned | Pass | Forwarded mail | None; this is DKIM working |
| Fail | Fail or none | Fail | Spoofing, or an unknown internal sender | Identify; if not yours, enforcement will block it |
The middle row is the one that matters before you move beyond p=none. Every legitimate source sitting in that row will be quarantined or rejected once you enforce. That is why the remediation stage of a staged rollout exists, and why policy changes should follow evidence rather than a calendar.
Alignment work is the bulk of what MailMarq does in the Remediate stage: identifying each legitimate sender in your reports, working out which lever it supports, and supplying or applying the exact records. Our five-stage process explains how that leads safely to enforcement, and a free assessment is a good place to start.
Frequently asked questions
If SPF passes, why does my DMARC report show a failure?
Because SPF passed for the envelope sender domain, which belongs to the sending platform rather than to you. DMARC requires the authenticated domain to align with the visible From domain.
Do I need both SPF and DKIM to align?
No. DMARC passes if either aligned SPF or aligned DKIM passes. Aiming for aligned DKIM on every sender is the stronger position because it survives forwarding.
Should I use strict alignment for better security?
For most businesses, no. Relaxed alignment still requires the same organisational domain, and strict mode tends to break legitimate subdomain senders for little practical gain.
Can an attacker align by using a subdomain of my domain?
Only if they can send authenticated mail from that subdomain, which requires control of its DNS or a compromised account on a service you authorised. That is why unused senders should be removed from your records.
Sources and standards
- RFC 7489, section 3.1: Identifier Alignment. How DMARC decides whether the SPF and DKIM domains match the From domain.
- Microsoft: Outlook’s new requirements for high-volume senders. The April 2025 announcement of SPF, DKIM and DMARC enforcement for domains sending more than 5,000 messages a day.
MailMarq
MailMarq is a managed DMARC service run from Johannesburg. Our team has built and managed business websites, hosting and email infrastructure for South African companies since 2016, and writes these guides from work on real domains.
Keep reading
How Much Does DMARC Cost in South Africa?
The DNS record is free; the work is not. A frank breakdown of what DIY, self-service software and managed DMARC really cost a South African business.
DMARC Checker Results Explained: What Each Status Means and What to Fix First
A DMARC checker gives you a wall of statuses. This guide translates each one into plain language and gives you a priority order for fixing them.
Managed DMARC vs DMARC Software: Which Does Your Business Need?
DMARC software and managed DMARC both process your reports. The difference is who does the work afterwards. A frank comparison and a framework for choosing.
Find out where your domain stands
Send us your domain. We will review your DMARC, SPF and DKIM set-up, map the services sending as you, and tell you plainly what it would take to reach enforcement. No charge and no obligation.