DMARC alignment: why a passing signature may not be enough
Alignment relates an authenticated domain to the domain shown in the message’s From identity. It explains why a message can show a passing authentication result yet still fail DMARC. Diagnose the identities used by the actual message rather than looking only for a published DMARC record.
Open the relevant free tool →A pass needs an aligned authenticated domain
Write down the identities
From a message you are authorised to inspect, record the visible From domain, the SPF-related identity reported by the receiver and any DKIM signing domain. Do not treat these as interchangeable. A third-party service may authenticate its own domain correctly while the visible sender uses yours.
Understand the passing path
DMARC can pass through aligned SPF or aligned DKIM. Alignment rules can be relaxed or strict, and the domain relationship matters. The presence of a DMARC policy does not make an unaligned message aligned. Likewise, a standalone SPF or DKIM pass badge is insufficient without knowing which domain passed.
Use the receiver’s result carefully
Authentication-Results headers can help explain how a receiving system evaluated the message. Treat pasted headers as data, not unquestionable proof: an arbitrary header can be inserted before the trusted receiving boundary. For an operational investigation, use the message view or logs from the system you trust and compare the reported identities with the sender configuration.
Fix the sending service configuration
If a third-party sender uses the wrong identity, follow that service’s custom-domain or signing setup instructions. Test the exact sending stream after the update. Do not solve an alignment problem by copying a random DMARC record or removing policy without checking the legitimate traffic. Keep the owner of each sending service involved in the configuration inventory.
Distinguish lookup from message evaluation
The DMARC checker shows the domain’s published record and basic findings. It does not receive or verify a complete message on your behalf. Pair the lookup with actual header evidence when diagnosing a failure. For recipient verification, use the address tools instead: sender alignment and recipient mailbox existence are different problems that need different inputs.