Why Does DMARC Fail Even When SPF and DKIM Pass?

You open a DMARC aggregate report, or paste a test message into a header analyzer, and get this: `spf=pass`, `dkim=pass`, `dmarc=fail`. It looks like a contradiction. Two authentication checks succeeded and the one that depends on them failed.

It isn't a bug. DMARC doesn't ask "did SPF pass?" It asks "did SPF or DKIM pass for the same domain the recipient sees in the From header?" That second half is called alignment, and it's the cause of roughly every "everything passes but DMARC fails" ticket I've seen.

{"h2":"Three different domains are in play"}

A single email carries at least three sender domains, and users only ever see one of them.

{"ul":["The From header — `From: ana@acme.com`. This is what the recipient reads and what DMARC protects.","The envelope sender (MAIL FROM / Return-Path) — where bounces go, e.g. `bounces@em1234.sender.net`. SPF is checked against this domain, not the From header.","The DKIM signing domain (`d=`) — whoever holds the private key that signed the message, e.g. `d=acme.onmicrosoft.com`."]}

SPF can pass perfectly for `em1234.sender.net`. DKIM can pass perfectly for `acme.onmicrosoft.com`. Neither of those is `acme.com`, so from DMARC's point of view nothing has been proven about the domain in the From line — and it fails. That's the whole mechanism.

{"h2":"Relaxed vs. strict alignment, concretely"}

DMARC gives you two knobs: `aspf` (SPF alignment) and `adkim` (DKIM alignment). Each can be `r` (relaxed, the default) or `s` (strict).

Relaxed means the two domains must share an organizational domain — the registrable domain just below the public suffix. `mail.acme.com` and `acme.com` share `acme.com`, so they align. Strict means the domains must match exactly, character for character.

{"table":{"headers":["From domain","Authenticated domain (MAIL FROM or DKIM d=)","Relaxed","Strict"],"rows":[["acme.com","acme.com","Pass","Pass"],["acme.com","mail.acme.com","Pass","Fail"],["mail.acme.com","acme.com","Pass","Fail"],["acme.com","acme.onmicrosoft.com","Fail","Fail"],["acme.com","acme.com.abc123.gappssmtp.com","Fail","Fail"],["acme.com","em1234.sender.net","Fail","Fail"],["go.acme.com","acme.co.uk","Fail","Fail"]]}}

Two things to notice. First, `onmicrosoft.com` and `gappssmtp.com` are separate organizational domains — being "your" Microsoft or Google tenant name buys you nothing for alignment. Second, DMARC passes if either SPF or DKIM aligns and passes. So a DMARC failure means both failed to align, not one.

{"h2":"Read the headers in 60 seconds"}

Send a message to a Gmail address you control, open it, choose "Show original," and look at the `Authentication-Results` line. A failing one looks like this:

`spf=pass (google.com: domain of bounces@em1234.sender.net designates 198.51.100.7 as permitted sender) smtp.mailfrom=em1234.sender.net; dkim=pass header.d=sender.net; dmarc=fail (p=NONE sp=NONE dis=NONE) header.from=acme.com`

Three fields matter: `smtp.mailfrom`, `header.d`, and `header.from`. If neither of the first two shares an organizational domain with the third, DMARC fails. That's the entire diagnosis. You don't need a tool for it.

{"h2":"The six real-world causes"}

1. Microsoft 365 with default DKIM. Until you enable custom DKIM in the Defender portal and publish the two CNAMEs, M365 signs with `d=yourdomain.onmicrosoft.com`. SPF usually still aligns because M365 uses your domain in MAIL FROM, so DMARC often squeaks through — but if you've set `aspf=s` or the mail is relayed, you're exposed. Enable custom DKIM regardless.

2. Google Workspace without DKIM turned on. Google applies a default signature with `d=yourdomain.com.<hash>.gappssmtp.com`. It passes DKIM and aligns with nothing. Admin console → Apps → Google Workspace → Gmail → Authenticate email → generate the key, publish the TXT record, then click Start authentication. People skip that last click constantly.

3. An ESP or relay using its own bounce domain. Marketing platforms, ticketing systems, and transactional senders default to a shared Return-Path like `bounces@em1234.sender.net`. SPF passes for them, not for you. The fix is their "custom MAIL FROM" / "custom Return-Path" / "branded sending domain" feature, which asks you to CNAME something like `em.acme.com` to their infrastructure.

4. You set `adkim=s` or `aspf=s` and forgot. Strict alignment is a legitimate choice, but it breaks the moment any legitimate system signs as a subdomain. If your record reads `v=DMARC1; p=reject; adkim=s; aspf=s;` and your helpdesk signs with `d=support.acme.com`, that mail dies. Unless you have a specific spoofing threat model, leave both relaxed.

5. Forwarding. A recipient auto-forwards to another address. The forwarder rewrites the envelope sender to its own domain — SPF now evaluates the forwarder and fails alignment — and if the forwarder also modifies the body or subject (mailing lists love adding footers), the DKIM signature breaks too. Both legs fail, DMARC fails. There's nothing you can do about it on your end; this is why aggregate reports always contain some failure volume, and why you shouldn't panic at 97% pass instead of 100%.

6. Subdomain policy surprises. If your root record has `sp=reject`, every subdomain inherits reject even if you never configured DKIM for it. Mail from `notifications.acme.com` that was fine under `p=none` starts bouncing the day you tighten the root policy.

{"h2":"Fixing it"}

{"ul":["Turn on provider-native DKIM everywhere you send from — M365, Google Workspace, your ESP, your CRM, your invoicing tool. One key per sending system, each with its own selector. There is no limit on how many selectors a domain can have.","Where the provider offers a custom Return-Path, configure it. That fixes SPF alignment and gives you a second independent way to pass DMARC when DKIM breaks in transit.","Remove `adkim=s` and `aspf=s` unless you can name the reason they're there.","Publish `rua=mailto:dmarc@yourdomain.com` and actually read the first week of reports. Aggregate XML will tell you exactly which source IPs are failing which check — far faster than guessing.","Stay at `p=none` until aligned pass rates sit above ~95% for a couple of weeks, then move to `p=quarantine`, then `p=reject`. Going straight to reject on day one is how internal invoices disappear."]}

{"h2":"Why this matters more for cold email"}

On a cold sending domain you usually have exactly one sending system, so alignment should be trivial — and a failure is that much more damaging. Google and Yahoo's bulk sender rules require a DMARC record and DMARC-aligned authentication; Microsoft has tightened similar expectations for high-volume senders. A domain with `spf=pass dkim=pass dmarc=fail` on every message is a domain filters have every reason to treat as unverified.

Two extra traps specific to outbound. If you send from a subdomain like `go.acmemail.com` while the From header says `acmemail.com` (or vice versa), relaxed alignment saves you — strict doesn't. And if you're rotating across several fresh domains, each one needs its own DKIM key published and verified, not a copy-paste of the DNS from the first domain. A single un-published TXT record means that entire domain authenticates as nothing. Our cold email domain setup guide walks through the record-by-record build, and the plain-English SPF, DKIM, and DMARC guide covers the syntax itself.

{"h2":"Where Sendvanta fits"}

Sendvanta sends through your own Gmail, Microsoft 365, or SMTP mailboxes — never a shared relay — so the From domain and the authenticating domain are the same by design, and alignment is usually solved the moment your provider's DKIM is switched on. Its deliverability health scoring checks DKIM and DMARC at the domain layer alongside mailbox and IP signals, so a domain that's silently failing alignment surfaces as a warning instead of six weeks of quiet under-performance. You can connect mailboxes and run the checks on the free plan — $0, no card, 1,000 active leads and 3,000 emails a month.

{"faq":[{"q":"Can DMARC pass if SPF fails?","a":"Yes. DMARC passes if either SPF or DKIM passes with alignment. A message forwarded through a relay often fails SPF entirely but still passes DMARC on an intact, aligned DKIM signature — which is exactly why DKIM is the more durable of the two."},{"q":"Does the visible From name or the Reply-To affect DMARC?","a":"No. DMARC evaluates only the domain in the From header address. Display names and Reply-To addresses are ignored by the protocol, though filters may still judge a mismatched Reply-To as suspicious."},{"q":"Why do I see a small percentage of DMARC failures I can't explain?","a":"Almost always forwarding and mailing lists, where the envelope sender is rewritten and message content is modified. Expect a few percent of legitimate volume to fail permanently; judge readiness for p=reject on the trend across known sources, not on hitting 100%."},{"q":"Is relaxed alignment less secure?","a":"Marginally. Relaxed lets any subdomain of your organizational domain authenticate for the root. That only matters if an attacker controls one of your subdomains — in which case you have a bigger problem. For nearly every sender, relaxed is the right default."}]}