What DMARC alignment means
SPF and DKIM each answer a question about a message. DMARC asks a third one, and it is the only one receivers act on: does the domain the reader sees match the domain that authenticated? That match is called alignment, and a message can pass SPF or DKIM and still fail DMARC because of it.
The two ways a message can align
SPF alignment. SPF checks the envelope sender — the address the receiving server is told to bounce to, which the reader never sees. SPF is aligned when that envelope domain matches your From: domain. A mail vendor that sends on your behalf usually bounces to its own domain, so SPF passes and does not align.
DKIM alignment. DKIM is a signature over the message itself, carrying the domain that signed it. It is aligned when that signing domain matches your From: domain.
DMARC needs one of the two. That is why a domain can sit at a flawless pass rate on one leg alone.
Why the leg matters, even when you are passing
SPF alignment does not survive forwarding. When someone forwards your message — a mailing list, a redirect from an old address, a colleague's rule — the forwarding server sends it, and that server is not in your SPF record. SPF fails. Nothing is broken; this is just how forwarding works.
DKIM alignment does survive it. The signature travels with the message, so it still verifies after a forward as long as the body was not rewritten.
So a domain passing DMARC entirely on SPF looks perfect in its reports and fails the moment
anyone forwards its mail. At p=none nobody notices. At p=quarantine
that forwarded mail goes to spam, and at p=reject it is refused outright. This
is why Sojka calls a source green only when it is DKIM-aligned, and why it
will not recommend enforcement to a domain that passes on SPF alone.
Reading your own reports
In the report log, each row is one sending source and shows both legs. The combinations mean different things:
- DKIM pass and aligned — this is the durable state. Nothing to do.
- SPF ✓, DKIM pass but not aligned — the message is signed, but by somebody else's domain (your mail vendor's, typically). It passes today and breaks on forwarding. See not DKIM-aligned.
- Neither aligned — the message fails DMARC. Either it is a legitimate sender you have not authorised yet, or it is not yours at all. Failing sources that keep appearing from one place are usually the first; a scatter of one-off IPs from countries you do not do business in is usually the second, and that is DMARC doing its job.
Before you change a key
If DKIM verifies but does not align, check your DMARC record for adkim=s first.
Strict alignment requires an exact domain match, so a signature from
mail.example.com fails alignment for example.com even though it is
yours. Relaxed alignment — adkim=r, and the default when the tag is absent —
accepts it. Loosening the tag is the fix there; generating a new key is wasted work.
More generally: never rotate a key that is verifying. A signature that passes is evidence the key is correct, whatever else is wrong.
Next
- Your mail is not DKIM-aligned — the fix, per platform.
- Your mail is not SPF-aligned — when this is worth fixing.
- Check a domain — free, reads public DNS only.