Alignment is the DMARC rule that fails while everything passes

Every checker says SPF passes. Every checker says DKIM passes. DMARC fails, and nobody can see why.

The answer is alignment, and it is the only part of email authentication that can be wrong while every individual component reports success.

What DMARC actually asks

SPF asks: was this server allowed to send for the return-path domain?

DKIM asks: was this message signed by a key published under the signing domain?

DMARC asks a third question neither of those covers: does the domain that authenticated match the domain in the From header the recipient sees?

That last domain is the one that matters, because it is the only one a human reads. Authentication against a domain nobody sees protects nobody.

How it goes wrong

You send as billing@yourcompany.com through a provider. The provider uses its own return-path — bounces@provider.net — so SPF is evaluated against provider.net and passes. The provider signs with its own key, so DKIM is evaluated against provider.net and passes.

Both pass. Neither aligns with yourcompany.com. DMARC fails.

If your policy is p=none nothing visible happens, which is why this survives for years. The mail is scored worse than it should be and nobody connects the two.

Relaxed and strict

DMARC has two alignment modes, set per mechanism with aspf and adkim.

Relaxed, the default, matches on the organisational domain. A return-path of mail.yourcompany.com aligns with a From of yourcompany.com. This is what you want almost always.

Strict requires an exact match. It breaks the extremely common pattern of sending from a subdomain, and it buys you very little. Leave it relaxed unless you have a specific reason not to.

Fixing it

Either mechanism aligning is enough — DMARC does not require both.

Align DKIM. This is the better fix. Publish a DKIM key under your own domain and have the provider sign with it, so d= is yourcompany.com. Most providers support this; it is usually described as a custom or authenticated sending domain and it is the reason this platform generates a key per customer domain rather than signing everything with one shared key.

Align SPF. Set a custom return-path on a subdomain you control, usually by publishing a CNAME the provider gives you. SPF then evaluates against your subdomain and aligns in relaxed mode.

Doing both is better than either, because DKIM survives forwarding and SPF does not. A forwarded message arrives from the forwarder's server, so SPF fails at that point; the DKIM signature travels with the message and still verifies.

Seeing it

DMARC aggregate reports are the only reliable view. Each record shows the SPF result, the DKIM result, and — separately — whether each aligned. A report full of pass on the mechanism and fail on alignment is exactly this problem.

Publish p=none with a rua address and read what comes back for a fortnight before changing anything. The DMARC checker will tell you whether reports are configured to go anywhere at all, which is the first thing to confirm.