Can DMARC fail if SPF passes?

Yes. SPF must pass and the domain it checked must align with the domain in the From header. A pass for a different domain does not count.

Does DMARC need both SPF and DKIM to align?

No. One aligned pass is enough. DMARC fails only when neither SPF nor DKIM gives an aligned pass.

Can a scan of my DNS tell me if my mail aligns?

Not fully. A scan reads your published records. Alignment is decided per message, so you need the headers of a real message to be sure.

← blog

Why DMARC fails when SPF and DKIM both pass

2026-11-01 · By Arshad Ansari · dmarc · spf · dkim · email-security

dmarcspfdkimemail-security

DMARC can fail even when SPF and DKIM both show "pass". The reason is alignment.

The short answer

DMARC does not ask only "did SPF or DKIM pass?" It asks: "did one of them pass for the same domain the reader sees in the From address?"

SPF alignment: the domain in the envelope sender (also called Return-Path or MAIL FROM) must match the From domain.
DKIM alignment: the domain in the d= tag of the DKIM signature must match the From domain.

One aligned pass is enough. If both passes are for other domains, DMARC fails.

The usual cause

A third-party service sends mail for you. It uses its own bounce domain for SPF and signs with its own DKIM domain. Both checks pass, but for the service's domain, not yours. The From address still shows your domain. Nothing aligns.

How to confirm

Open the full headers of a message that failed. Find Authentication-Results. Compare three values:

header.from (the From domain)
smtp.mailfrom (the SPF domain)
header.d (the DKIM domain)

If neither of the last two matches the first, you have found the problem.

Relaxed or strict

The DMARC record sets the mode with aspf and adkim. The default is relaxed. In relaxed mode a subdomain of the same organisational domain counts as a match, so mail.example.com aligns with example.com. Strict mode needs an exact match.

How to fix it

Find every service that sends mail with your domain in the From address.
In each service, set up custom DKIM signing with your own domain. This is the most reliable fix, because DKIM usually survives forwarding.
Where the service allows it, set a custom return-path domain on your domain so SPF aligns too.
Re-send a test message and read the header again.

Forwarding is a separate trap. A forwarder changes the sending server, so SPF often breaks. An aligned DKIM signature is what keeps DMARC passing in that case.

What a scan can and cannot tell you

A scan of your domain reads public records. It can show whether you publish SPF, DKIM and DMARC records, and what your DMARC policy and alignment settings are. It cannot see which services actually send your mail, or whether a given message aligned. For that, you need the header of a real message or your DMARC reports.

The free Domain Posture scan runs 18 checks on any domain with no signup, including SPF, DKIM and DMARC. Each result is dated and can be re-run: https://www.domainposture.com

Frequently asked questions

Can DMARC fail if SPF passes?: Yes. SPF must pass and the domain it checked must align with the domain in the From header. A pass for a different domain does not count.
Does DMARC need both SPF and DKIM to align?: No. One aligned pass is enough. DMARC fails only when neither SPF nor DKIM gives an aligned pass.
Can a scan of my DNS tell me if my mail aligns?: Not fully. A scan reads your published records. Alignment is decided per message, so you need the headers of a real message to be sure.