SummaryRead the domains beside the authentication results. DMARC needs aligned SPF or aligned DKIM to pass; an SPF pass for an unrelated return-path domain is insufficient.
In this guide
An SPF pass answers only part of the question
SPF checks whether a server is authorised for an envelope-sender domain. DMARC asks whether a passing SPF or DKIM result aligns with the domain in the message’s visible From address. A provider can pass SPF for its own domain without establishing that connection to yours.
DMARC passes when at least one of these paths succeeds: SPF passes with an aligned domain, or a DKIM signature passes with an aligned signing domain. Both passing results are useful, but DMARC does not require both paths to succeed. See the DMARC standard’s alignment rules.
Read an SPF-pass, DMARC-fail example
The following is a constructed header excerpt, not a customer message. It uses fictional domains and simplified authentication results to make the relationship clear.
From: Studio <hello@studio.example>
Return-Path: <bounce@mailer.example>
Authentication-Results: mx.receiver.example;
spf=pass smtp.mailfrom=mailer.example;
dkim=pass header.d=mailer.example;
dmarc=fail header.from=studio.example- From
- The identity shown to the reader:
studio.example. - SPF domain
- The envelope-sender domain:
mailer.example. Its SPF pass authenticates the sending server for that domain. - DKIM domain
- The domain of the passing signature: also
mailer.example. - DMARC result
- A fail, because neither passing identity connects to
studio.example.
Adding the provider’s include to studio.example would not change this message’s SPF identity. The receiver is evaluating mailer.example. Nor does changing an SPF qualifier make two unrelated domains align.
Fix the passing identity that should represent your domain
There are two common configuration paths. Choose the one the sending service supports, and configure both when appropriate.
Configure custom-domain DKIM
Ask the service to sign using your domain, following its account-specific DNS instructions. Publishing the required key or CNAME is only part of the setup; verify that the service is actually signing outgoing messages with that domain.
In the constructed example, changing the passing DKIM signing domain to studio.example would create an aligned DKIM path. SPF could continue to pass for mailer.example, and DMARC could now pass through DKIM. Microsoft documents this provider-side setup for custom-domain DKIM in Microsoft 365.
Configure a custom MAIL FROM or return-path domain
If the provider supports it, configure an envelope-sender domain under your control and publish the exact records it supplies. For example, a service might use bounce.studio.example while the visible From remains studio.example.
The service may require more than an SPF TXT record, such as a bounce-handling MX record. Do not move your main mailbox MX records to accomplish that. Amazon’s custom MAIL FROM documentation provides a concrete example of a provider-specific setup.
Check relaxed and strict alignment
Under relaxed alignment, the authenticated and From domains must share an organisational domain. Strict alignment requires the exact domain. DMARC uses aspf for SPF alignment and adkim for DKIM alignment; the default is relaxed.
| Passing identity | Relaxed | Strict |
|---|---|---|
studio.example | Aligned | Aligned |
bounce.studio.example | Aligned | Not aligned |
mailer.example | Not aligned | Not aligned |
A strict-policy failure is a configuration decision to investigate, not a reason to weaken a policy automatically. An aligned DKIM signature can provide the passing path even when the provider’s subdomain-based SPF setup cannot meet strict SPF alignment. Amazon explains that constraint for SES in its DMARC configuration guidance.
Use the receiving system’s results
Collect a fresh message at a mailbox you control, and inspect the results added by that recipient’s trusted mail system. Messages may contain several Authentication-Results headers from different hops, and an arbitrary header supplied by a sender is not trustworthy evidence.
Record the SPF domain, each relevant DKIM signature result and domain, the visible From domain, and the DMARC result. If an exact or relaxed alignment match appears to exist but DMARC still fails, check that you are comparing results from the same evaluation, using the effective alignment settings, and reading a fresh message.
Microsoft’s header reference explains the authentication fields. An SPF record inspection alone cannot establish DKIM or DMARC success.
Account for forwarding and message changes
Forwarding can change the connecting server and break an SPF path that passed on direct delivery. DKIM may survive forwarding when the signed content is preserved, but mailing lists or gateways that modify signed content can cause signature failure. Test direct delivery and the real forwarding route separately.
Do not add arbitrary forwarding infrastructure to your domain’s authorisations to make one report green. Investigate the route and the receiver’s handling of authenticated forwarding information. Microsoft covers combined failures in its authentication troubleshooting guidance.
After a correction, retest each service and review available DMARC reports for remaining legitimate failures. Changing p=reject to p=none changes the requested handling of failures; it does not make the message authenticate successfully.
Emailmetry maintains compatible SPF policies. Alignment still depends on the identities and DKIM settings configured at your sending services. Use our SPF, DKIM and DMARC overview to review the complete setup.