DMARC Fail with SPF Pass: How to Fix Alignment

Quick answer

DMARC doesn't ask whether SPF or DKIM passed. It asks whether one of them passed for the same domain as the visible From address. That match is called identifier alignment. A message that passes SPF for bounces.vendor.example while showing From: news@example.com has a valid SPF pass and still fails DMARC for example.com.

To fix it, give each sender an aligned identity. In order of preference:

1. Turn on DKIM signing with your own domain (d=example.com or a subdomain of it) at every service that sends as you. One aligned DKIM pass is enough for DMARC, and DKIM usually survives forwarding.
2. Where the service offers it, set a custom return-path (bounce) domain under your domain, for example bounce.example.com, so SPF aligns too.
3. Keep adkim and aspf at the default relaxed mode unless you have a reason for strict.

What alignment means

DMARC (RFC 9989, the May 2026 update that replaced RFC 7489) evaluates the domain in the message's From: header, which it calls the Author Domain. A message gets a DMARC pass when either of these is true:

• SPF passed, and the domain SPF checked aligns with the From domain. DMARC only uses the SPF result for the MAIL FROM identity (the envelope sender, shown as Return-Path or smtp.mailfrom). When MAIL FROM is empty, as it is on bounce messages, SPF checks postmaster@ the HELO name instead.
• DKIM produced a valid signature, and the signing domain (the d= tag) aligns with the From domain. If a message has several signatures, any one aligned pass is enough.

RFC 9989 explains why alignment is required: anyone, including an attacker, can publish SPF for their own domain or sign with their own DKIM key and get a pass. A pass only proves something about your domain when it is for your domain.

Relaxed vs strict alignment

The aspf tag sets the mode for SPF and adkim for DKIM. Both default to r (relaxed); s means strict, so the domains must be identical. RFC 9989 notes that nearly all domain owners find relaxed alignment sufficient. Comparisons are case-insensitive.

Relaxed alignment compares organizational domains. RFC 9989 finds the organizational domain with a "DNS tree walk" that looks for _dmarc records up the name, instead of relying only on the Public Suffix List as RFC 7489 did. For ordinary domains such as example.com or example.co.uk the answer is the same.

Step 1: Read the headers of a failing message

Get a copy of a message that failed (a test send to an outside Gmail or Outlook.com mailbox works), open the original source and paste the headers into the Email Header Analyzer. In the Authentication-Results header, compare three domains:

Authentication-Results: mx.receiver.example;
  spf=pass smtp.mailfrom=bounces.vendor.example;
  dkim=pass header.d=vendor.example;
  dmarc=fail header.from=example.com

• header.from is the domain DMARC protects.
• smtp.mailfrom is the domain SPF checked. It must share the organizational domain with header.from (or match exactly under aspf=s).
• header.d is the DKIM signing domain. Same rule, under adkim.

In this example both SPF and DKIM passed, but for the vendor's domains, so DMARC failed. Microsoft 365 adds its own compauth verdict next to these results; see what the Microsoft 365 compauth reason codes mean.

Step 2: Find which senders are unaligned

One header shows one message. Your DMARC aggregate reports show every source. Load them into the DMARC Report Analyzer: it flags sources where SPF passed but wasn't aligned, where DKIM passed but wasn't aligned, and sources that failed both. No reports yet? Add a rua= address with the DMARC Record Generator and wait a day or two.

Fix 1: Sign with your own domain at every sender

This is the most reliable fix, because DKIM signatures usually survive forwarding and SPF doesn't. Most email platforms, CRMs, helpdesks and newsletter tools have a "domain authentication" or "custom DKIM" setting that gives you one or more CNAME or TXT records to publish under your domain. Once published and verified, their mail carries d=example.com (or d= a subdomain of it), which aligns under relaxed mode.

• Microsoft 365: publish the selector1/selector2 CNAMEs and enable signing for each custom domain (see DKIM for Microsoft 365). Until you do, mail is signed with your onmicrosoft.com domain, which doesn't align.
• Google Workspace: generate a key and publish the google._domainkey TXT record (see the Google Workspace guide).
• Check the result with the DKIM Checker, which finds published selectors and validates the keys.

Fix 2: Use a custom return-path domain

Many bulk-mail and transactional services send with their own bounce domain in MAIL FROM so they can process bounces. SPF then passes for their domain, which is why the message shows SPF pass and DMARC fail. Adding the vendor's include to your own SPF record doesn't change this, because receivers never check your record for those messages.

If the service offers a custom return-path, custom MAIL FROM or custom bounce domain, point a subdomain such as bounce.example.com at it (usually a CNAME they give you). SPF then passes for a subdomain of yours and aligns under relaxed mode. If you use strict aspf=s, a subdomain return-path no longer aligns, which is one reason to stay relaxed.

Fix 3: Forwarding and mailing lists

When a message is forwarded, the forwarder's server sends it on from its own IP address, which isn't in your SPF record, so SPF fails or the forwarder rewrites MAIL FROM to its own domain. Either way, SPF stops helping DMARC. An aligned DKIM signature usually survives plain forwarding, which is why Fix 1 matters most.

Mailing lists that add a subject tag or a footer change the signed content, so the DKIM signature can break too (headers then show dkim=fail (body hash did not verify) or signature did not verify; see how to fix DKIM body hash did not verify). Many lists rewrite the From address to their own domain for senders at p=quarantine or p=reject. Some receivers also use ARC (RFC 8617) headers from trusted forwarders to decide whether to override a DMARC failure; in your DMARC reports this shows up as a reason such as forwarded, mailing_list or trusted_forwarder. You can't fix other people's forwarders, but signing everything with DKIM keeps most forwarded mail passing. The DMARC fail after forwarding or on mailing lists guide covers SRS, From rewriting, ARC and Microsoft 365 trusted ARC sealers in detail.

Fix 4: Check the From domain itself

• Subdomain senders. Mail from news.example.com with DKIM d=example.com aligns in relaxed mode but not strict. If you set adkim=s or aspf=s, every subdomain sender needs an identity at exactly that subdomain.
• Look-alike domains. A vendor may be configured with example-mail.com or an old brand domain. That is a different organizational domain and never aligns with example.com.
• Broken From headers. RFC 9989 says alignment can't happen for a message with a missing, malformed or repeated From header, so some form tools and scripts fail no matter how SPF and DKIM are set up.

Verify the fix

1. Send a new test message from each service and confirm dmarc=pass, with smtp.mailfrom or header.d under your domain, in the Email Header Analyzer.
2. Check your published records together with the Email Deliverability Checker (SPF, DKIM, DMARC and MX), and your policy and adkim/aspf values with the DMARC Record Checker.
3. Watch a week of aggregate reports in the DMARC Report Analyzer before moving to p=quarantine or p=reject.

Audit hundreds of domains at once

Need SPF, DMARC and MX checks across a whole client list? Run the Bulk SPF / DMARC / MX Auditor on Apify ($2 per 1,000 domains).

Related tools and guides

Decode Authentication-Results with the Email Header Analyzer, find unaligned sources in your DMARC reports, check selectors with the DKIM Checker, and review your policy with the DMARC Record Checker. Platform guides: DMARC for Microsoft 365, DKIM for Microsoft 365 and SPF, DKIM and DMARC for Google Workspace. Over the SPF lookup limit as well? See fix SPF too many DNS lookups.

FAQ

Why does DMARC fail when SPF passes?

Because DMARC requires alignment. SPF must pass for the MAIL FROM (Return-Path) domain, and that domain must share the organizational domain with the visible From address (or match it exactly with aspf=s). Third-party senders often use their own bounce domain, so SPF passes for them, not for you.

Do I need both SPF and DKIM to be aligned for DMARC?

No. DMARC passes if either SPF or DKIM passes and is aligned with the From domain. Aligning DKIM at every sender is the most reliable choice because DKIM usually survives forwarding.

What is the difference between relaxed and strict alignment?

Relaxed (the default, adkim=r and aspf=r) only requires the same organizational domain, so bounce.example.com aligns with example.com. Strict (s) requires the domains to be identical.

Does adding a vendor include to my SPF record fix DMARC alignment?

Only if the vendor sends with your domain or a subdomain of it in MAIL FROM. If it uses its own bounce domain, receivers check the vendor's SPF record instead, so your include has no effect. Set up DKIM with your domain at the vendor, or a custom return-path domain.

Why does forwarded mail fail DMARC?

The forwarder sends from an IP address that is not in your SPF record, so SPF no longer passes for your domain. If the message also has an aligned DKIM signature that the forwarder did not break, DMARC still passes.

Want the full kit?

Runbooks, checklists and helpdesk templates: IT Admin Packs on Gumroad.