DMARC fails but SPF and DKIM pass: how to find the cause

You open a DMARC report or a message header and see spf=pass and dkim=pass next to dmarc=fail. Nothing is broken in the way it looks: both checks passed, just not for the domain DMARC cares about. This guide is a troubleshooting path for that exact situation. It assumes you already know what alignment is and want to find which of the usual causes you have, in the order they are most likely.

The short answer#

DMARC passes when SPF or DKIM passes and aligns with the domain in the visible From address. "Pass" and "aligned" are separate questions. SPF is compared against the Return-Path (envelope sender) domain, and DKIM is compared against the d= domain in the signature. If your email service signs with its own domain and bounces through its own domain, both checks pass and neither aligns. The fix is almost always the same: set up a custom DKIM signing domain on your own domain, and a custom return-path domain if you want SPF to align too. Check strict-mode tags, forwarding and subdomains only after that. For the concept itself, see the SPF, DKIM, and DMARC explainer.

What each check is compared against#

Every message carries three domains that matter, and DMARC lines them up in pairs. Most confusion disappears once you can name which one each check uses.

Here is what the classic failure looks like in a received message. The From is yours, both checks pass, and both of the other two domains belong to the sender:

Authentication-Results: mx.receiver.example;
  spf=pass smtp.mailfrom=bounce.mail.vendor.example;
  dkim=pass header.d=mail.vendor.example;
  dmarc=fail header.from=yourdomain.com

The email header analyzer shows the SPF, DKIM and DMARC verdicts and the From and Return-Path fields. Read the DKIM d= value yourself from the DKIM-Signature line. If you only have an aggregate report, the same information sits in auth_results (raw results and domains) versus policy_evaluated (the aligned verdict). The report-reading guide explains that split.

The decision path#

Work down this list and stop at the first step that matches. Each step is a different root cause with a different fix.

1. DKIM passes, but d= is the sender's domain. This is the most common cause and the best fix. Enable custom DKIM signing (sometimes called a branded or authenticated domain) in the sending service so it signs with d=yourdomain.com or a subdomain of it. DKIM travels with the message, so it keeps aligning after forwarding.
2. SPF passes, but the Return-Path is the sender's domain. SPF can only align if the envelope sender is your domain. Configure a custom return-path (bounce) domain in the service, usually a subdomain such as bounce.yourdomain.com pointed at the provider by CNAME or by MX and TXT records they give you. Adding the provider to your own SPF record does not fix this: SPF is checked against the domain in the Return-Path, which is the provider's, so your record is never consulted for that message.
3. Both are custom but DMARC still fails. Look at adkim and aspf in your DMARC record. If either is s (strict), the match must be exact, so a signature from mail.yourdomain.com does not align with From yourdomain.com. Either sign with the exact From domain or remove the strict tag.
4. It fails only for some sources or only at some receivers. Suspect forwarding, a mailing list or a security gateway that rewrites mail. See the section on forwarding below.
5. It fails only on a subdomain. Check whether the subdomain has its own SPF and DKIM, and which DMARC record applies to it. See the subdomain section.
6. Nothing passes at all. That is not alignment. SPF or DKIM is missing or broken for that source, which is a different, simpler problem.

Relaxed versus strict, in practice#

The default is relaxed for both. Under relaxed alignment the two domains only need to share an Organizational Domain, so a Return-Path of bounce.yourdomain.com aligns with a From of news.yourdomain.com. Under strict they must be identical.

_dmarc.example.com.  TXT  "v=DMARC1; p=none; rua=mailto:dmarc@example.com; adkim=r; aspf=r"

Leave both at r unless you have a written reason. Strict mode rarely stops a real attack that relaxed mode would allow, and it is a frequent cause of legitimate subdomain mail failing. One detail changed in the current standard: RFC 9989 (May 2026) obsoletes RFC 7489 and defines the Organizational Domain by a DNS tree walk rather than by a public suffix list. If you run unusual multi-label domains, check how your receivers apply it.

Why forwarding breaks one check but not the other#

When a message is forwarded, the forwarding server sends it onward from its own IP. SPF is evaluated against the connecting IP, so SPF fails or no longer aligns. That is why a source can show healthy DMARC at one receiver and failures at another: the failures are the forwarded copies.

DKIM usually survives forwarding, because the signature is carried inside the message. It breaks when the forwarder or a mailing list changes what was signed, for example by adding a footer or editing the subject. That is why the advice is the same every time: get DKIM aligned for every source, so DMARC can pass even when SPF cannot.

You cannot fully fix forwarding from your side. Small leftover failures that trace back to forwarders and lists are normal, which is one reason to judge progress by trend and by source rather than by one bad day.

Subdomain mismatches#

A subdomain does not inherit your parent's SPF record, and DKIM keys are looked up under each selector and domain, so a subdomain that sends mail needs its own authentication. The DMARC policy is different: if the subdomain publishes no DMARC record of its own, receivers find the parent's record, and the parent's sp= tag (if present) sets the subdomain policy.

Two checks catch most subdomain trouble. First, confirm the sending service signs with a domain that matches the From subdomain, or the parent in relaxed mode. Second, if you have set sp=reject on the parent, confirm every sending subdomain is passing before you rely on it. The sending subdomain guide covers how to structure this so each mail stream stays isolated.

Finding the failing source quickly#

The expensive part of an alignment failure is not the fix, it is finding which source needs it. Your reports group mail by sending IP, so a source that signs with its own domain shows up as a row with a low DMARC percentage.

Qualisend DMARC reports shows each source with separate DMARC, DKIM and SPF percentages, and flags rows under 100%. A source that signs and bounces through the vendor's own domains shows low DMARC, DKIM and SPF percentages together, which is the pattern from step 1 or 2 above. The page does not show the d= domain or the Return-Path for each row, so you still take one message from that source and read its headers to see which of the two domains is wrong. It also reports only what receivers send back, so a receiver that sends no aggregate reports is invisible in it.

For a first look without an account, the free DMARC report analyzer reads one report file in your browser. To test a sender end to end, send a message to the free email deliverability test and read its authentication results.

A per-service checklist#

Every sending service uses its own words for the settings, but the work is the same four items. Check each one in the service's own documentation rather than trusting a cheat sheet, because menus and defaults change.

• Custom DKIM domain. Look for "authenticate your domain", "branded sending domain" or "DKIM". Publish the keys it gives you. A new selector name does not conflict with your existing ones.
• Custom return-path domain. Look for "custom bounce domain", "return-path" or "link branding". This is often a separate setting from DKIM.
• From address. Confirm the From uses your domain. A From on a free mail domain, sent through a third party, cannot align with anything of yours.
• One change at a time. Make the change, send a test, read the header, then check the next report. Several changes at once make it impossible to see which one worked.

When to stop and when to worry#

You are ready to think about enforcement when every legitimate source passes DMARC through at least one aligned check, and the failures left belong to forwarders or to mail you do not recognize. If you are still working out how to get there, the DMARC setup guide has the rollout order, and the sender requirements guide explains why aligned DMARC now matters for bulk mail.

Alignment tells receivers the mail is really yours, but it says nothing about the list behind it. Once your sources are all passing, check a few addresses with the free email checker, which tests syntax, MX records and typos for one address at a time. For a whole list, the free plan on the pricing page gives you 100 credits that run the full verification, because a perfectly aligned domain still needs a healthy list to earn the inbox.