DMARC Alignment Failures Causing Delivery Problems

Advanced Email Deliverability

Emails are failing DMARC checks because the domain in the From header does not align with the domain that passed SPF or DKIM authentication. DMARC requires at least one of SPF or DKIM to pass and also to be aligned with the RFC5322 From domain. Misaligned third-party senders, forwarding services, and misconfigured ESPs are common sources of alignment failures.

Symptoms

⚠ DMARC aggregate reports show high dmarc=fail counts even when SPF and DKIM individually pass
⚠ Authentication-Results shows `dmarc=fail (p=quarantine)` or `dmarc=fail (p=reject)`
⚠ Emails sent through a third-party service arrive but are quarantined at strict DMARC receivers
⚠ Forwarded emails from other domains fail DMARC at the final destination
⚠ Subdomain mail (e.g., from newsletters.example.com) fails DMARC on the apex `example.com` policy
⚠ DMARC failure forensic reports (ruf=) arrive with details showing mismatched From domains

Possible Root Causes

• Third-party ESP sends using its own domain in the SMTP envelope and DKIM signature without also signing with your domain's key
• Email forwarding rewrites the SMTP envelope but not the From header, breaking SPF alignment
• Subdomain sending (e.g., from [email protected]) when the parent domain has `sp=reject`
• Mailing list managers that resend with the original From address but their own envelope and DKIM
• Strict alignment mode (`aspf=s` or `adkim=s`) rejecting subdomain senders that would pass relaxed checks

Diagnosis Steps

Step 1: Understand DMARC Alignment Requirements

DMARC passes only if one of these conditions is true:

SPF alignment: The domain in the SMTP envelope MAIL FROM matches (or is a subdomain of) the RFC5322 From domain
DKIM alignment: The d= value in the DKIM-Signature header matches (or is a subdomain of) the RFC5322 From domain

Strict vs Relaxed alignment:

_dmarc.example.com TXT "v=DMARC1; p=reject; aspf=r; adkim=r; ..."
# aspf=r (relaxed): mail.example.com aligns with example.com
# aspf=s (strict): only exact match passes

Step 2: Inspect Authentication-Results Headers

In a failing message, find:

Authentication-Results: mx.google.com;
  dkim=pass header.d=sendgrid.net;      # DKIM passes but d= is sendgrid.net, not example.com
  spf=pass smtp.mailfrom=sendgrid.net;  # SPF passes but mailfrom is sendgrid.net
  dmarc=fail (p=reject) header.from=example.com

Neither DKIM nor SPF aligns with example.com in the From header.

Step 3: Query DMARC Policy

dig TXT _dmarc.example.com +short
# "v=DMARC1; p=reject; rua=mailto:[email protected]; adkim=r; aspf=r"

# Check subdomain policy (sp= overrides for subdomains)
# If sp= is absent, subdomains inherit the parent p= value

Step 4: Review DMARC Aggregate Reports (RUA)

Parse the XML reports from your rua= address or use a service:

# Download and extract the report (gzipped XML)
gunzip dmarc-report.xml.gz
xmllint --format dmarc-report.xml | grep -A5 "policy_evaluated"

Key fields: disposition, dkim result, spf result, header_from vs envelope_from.

Step 5: Identify the Misaligned Sender

Check the source_ip field in the report and reverse-DNS it to identify the sending service
Cross-reference with your list of authorised senders

Solution

Fix: Configure the ESP to Sign with Your Domain

Most modern ESPs support custom DKIM signing. Add a DKIM record for the ESP's selector under your domain:

# Your ESP provides a selector and public key, e.g.:
# s2024._domainkey.example.com TXT "v=DKIM1; k=rsa; p=<key-provided-by-esp>"

# Once published, instruct the ESP to sign outbound mail with d=example.com s=s2024
# This achieves DKIM alignment with your From: example.com domain

Fix: Custom Return-Path (SPF Alignment)

Configure the ESP to use a custom subdomain for the SMTP envelope:

# Bounces.example.com is the custom return-path subdomain
# Publish SPF for this subdomain:
# bounces.example.com TXT "v=spf1 include:sendgrid.net -all"

# The SMTP MAIL FROM becomes: [email protected]
# SPF passes on bounces.example.com, and with relaxed alignment (aspf=r),
# this aligns with the From: [email protected] domain

Fix: Handle Email Forwarding with SRS

Sender Rewriting Scheme (SRS) rewrites the SMTP envelope on forward so SPF can pass at the next hop:

# On a Postfix forwarder, install and configure postsrsd:
sudo apt install postsrsd
# postfix main.cf additions:
# sender_canonical_maps = tcp:localhost:10001
# sender_canonical_classes = envelope_sender
# recipient_canonical_maps = tcp:localhost:10002
# recipient_canonical_classes = envelope_recipient,header_recipient

Fix: Adjust DMARC Policy for Subdomains

If legitimate subdomain senders are failing, set an explicit sp= value:

_dmarc.example.com TXT "v=DMARC1; p=reject; sp=quarantine; rua=mailto:[email protected]"

Prevention

Inventory every service that sends email with a From address at your domain; validate alignment before going live
Start with p=none and review RUA reports for 30 days before moving to p=quarantine or p=reject
Use a DMARC reporting platform (Dmarcian, Valimail, or EasyDMARC) to receive parsed, actionable alignment data
Require all new ESP integrations to support custom DKIM domain signing as a vendor requirement
Configure ARC sealing on legitimate forwarders and mailing lists to preserve authentication state through re-delivery

Related Protocols

DMARC SPF DKIM SMTP DNS

Related Terms

txt-record mx-record dns authoritative-dns