SPF passes. DKIM passes.
DMARC still fails.
Every dashboard shows green ticks and your mail still gets rejected. This is almost always alignment — and it is the single most common reason a business believes it is compliant when it is not.
What alignment actually means
SPF and DKIM each authenticate a domain. DMARC asks a further question that neither of them asks: is that domain the same one your recipient sees in the From: header?
Your recipient sees you@yourbrand.com. But:
- SPF authenticates the Return-Path (envelope sender) — which, with most
email platforms, is something like
bounces@mail.esp-domain.com. - DKIM authenticates whatever domain is in the signature's
d=tag — which, by default, is frequently the platform's domain rather than yours.
Both can pass perfectly. Neither is yourbrand.com. DMARC therefore fails, and at
p=reject the message is gone.
The rule that surprises people
DMARC passes if either SPF or DKIM aligns. You do not need both. That is useful, because DKIM alignment survives forwarding while SPF alignment does not — so if you fix only one, fix DKIM.
How to check it in about a minute
No tooling required. Send a message to any Gmail address, open it, click the three dots and choose Show original. You will see something like:
SPF: PASS with domain mail.esp-domain.com
DKIM: PASS with domain esp-domain.com
DMARC: FAILRead the domains, not the verdicts. If neither matches the domain in your From: address — or a subdomain of it — that is your answer. The green ticks were never telling you what you assumed.
| What you see | What it means |
|---|---|
| SPF pass, DKIM pass, DMARC fail | Alignment. Neither authenticated domain matches From:. |
| SPF fail, DKIM pass, DMARC pass | Fine. DKIM aligned, and one is enough. |
| DKIM pass on forwarded mail, SPF fail | Normal and expected — forwarding breaks SPF, not DKIM. |
| DMARC "none" | You have no DMARC record. Publishing one is step zero. |
The fix
You want the platform to sign with your domain rather than its own. Every serious sending platform supports this; it is variously called authenticated domain, branded sending domain, custom DKIM, or dedicated sending domain.
- 1 · Turn it onFind the sending-domain or domain-authentication setting in each platform you send from, and enter your domain.
- 2 · Publish the DNSThe platform gives you CNAME or TXT records. These delegate DKIM signing to them under a selector on your domain — usually something like
s1._domainkey.yourbrand.com. Add them exactly as given. - 3 · Wait, then verifyDNS propagates, the platform verifies, and the
d=tag in new messages becomes your domain. Re-run the Show-original check. - 4 · Repeat for every senderThis is the step people skip. Your ESP, your CRM, your helpdesk, your invoicing tool and the notification service someone wired up two years ago are all separate senders, each needing its own configuration.
Do not try to fix this with SPF alone
Adding the platform to your SPF record does not create alignment, because SPF authenticates the Return-Path, not the From:. It also burns one of your ten DNS lookups — exceed that and SPF returns permerror and stops working entirely. DKIM is the durable fix.
Finding the senders you have forgotten
Almost every business sends from more tools than anyone can list from memory. DMARC aggregate reports are
how you find them: publish p=none with a rua= address and receivers begin sending
daily XML summaries of everything sending as you — including things you did not know about.
The reports are unreadable by hand, which is why most people publish p=none, receive a few
thousand XML files, and quietly stop looking. Parsing them is the actual work, and it is what turns a
DMARC record from a checkbox into a list of things to fix.
Once every legitimate sender is aligned, you can move to enforcement — carefully. That is the engagement we run.
Forward us one message and we will read the headers
Send a message from your marketing tool to hello@spell.agency. We will tell you which domain each check authenticated, whether it aligns, and what it is costing you. Free, and it takes us ten minutes.
Book a call →