Get SPF and DKIM aligned so DMARC passes
A practical guide to making your return-path and DKIM signing domain match your visible From address, with the common alignment breakers and the fix for each.
To make DMARC pass, the domain that clears an authentication check has to match the domain in your visible From line. In practice that means two jobs: point the SPF return-path at your own domain, and get DKIM signing with d=yourdomain.com. Do either one and DMARC passes, because it only needs one aligned check. Here is how, and the usual things that get in the way.
What you are actually aligning
Two hidden pieces of a message decide alignment, and neither is the address your reader sees.
The first is the return-path, also called the envelope sender or MAIL FROM. It is the behind-the-scenes address that bounces go back to. SPF checks this domain, not the From line. For SPF to align, the return-path domain has to be your domain (or a subdomain of it, under relaxed alignment).
The second is the DKIM signing domain, carried in the signature as the d= tag. For DKIM to align, that d= value has to be your domain, again matching the From line.
Get one of the two lined up with your From address and you are done. You do not need both aligned, though having both is more resilient.
Fixing your own mail server
If you run your own mail, or use a standard business mailbox provider, this is usually already correct: you send as you@yourdomain.com, the return-path is on your domain, and DKIM signs with d=yourdomain.com. Confirm it rather than assume it, but this is rarely where the trouble lives.
The trouble lives with the other systems that send as you.
Breaker 1: third-party senders using their own domains
Your marketing platform, invoicing tool, help-desk, booking system and CRM all send mail showing your From address, but by default they send it through their own infrastructure with their own return-path and their own DKIM domain. SPF passes for them, DKIM signs for them, and neither aligns with your From line. DMARC fails even though every check went green.
The fix is to set up branded authentication with each provider, and it is almost always a DNS change on your side:
- Custom return-path. The provider gives you a subdomain to delegate, and you publish a
CNAMErecord pointing it at their infrastructure. Your return-path becomes something likebounce.yourdomain.com, which is a subdomain of your domain, so SPF aligns under relaxed alignment. - Custom DKIM. The provider gives you one or more
CNAMErecords (or aTXTrecord) to publish. Once live, the platform signs your mail withd=yourdomain.cominstead of its own domain, so DKIM aligns.
Most reputable providers document this under a name like “domain authentication”, “branded sending” or “custom DKIM”. You do it once per provider. This is the single highest-value alignment task for most businesses, because these platforms send a large share of your customer-facing mail.
Breaker 2: subdomains
If you send from a subdomain, say news.yourdomain.com for a newsletter, relaxed alignment already treats that as part of your organisational domain, so it aligns with a From line on either the subdomain or the parent. You only hit a wall if you have deliberately set strict alignment with adkim=s or aspf=s, which demands an exact match. Unless you have a specific reason for strict, leaving alignment on relaxed avoids this entirely.
One thing to check: each sending subdomain needs its own SPF and DKIM setup. A subdomain does not inherit the parent domain’s SPF record, so mail from news.yourdomain.com needs SPF published at that subdomain.
Breaker 3: forwarding
Forwarding is the awkward one. When a message is forwarded, a new server relays it, and that server is not on your SPF list, so SPF fails at the destination. There is nothing you can publish to authorize every possible forwarder in the world.
DKIM saves you here. Because the signature travels with the message and covers the content rather than the route, DKIM usually survives a forward intact. So aligned DKIM keeps DMARC passing through most forwarding, where SPF alone would not. This is the practical reason to prioritize getting DKIM aligned rather than leaning only on SPF. Some forwarding setups modify the message enough to break even DKIM, and those cases sit outside what you can fully control from the sending side, which we cover in when DMARC breaks legitimate mail.
A note on SPF’s limits
While you are in the SPF record, watch the 10 DNS lookup limit. Each include for a provider counts, and stacking too many pushes SPF into a permanent error where it stops passing for anyone. If your record is crowded, consolidating providers or flattening the record keeps it under the cap. SPF also caps a single string at 255 characters, so long records get split into quoted segments.
Confirm it with a check, then reports
After each change, verify it. The free DMARC checker analyzes your live records and shows whether they are set up sensibly. But the real proof is in your DMARC aggregate reports, which list every sending source and tell you, per source, whether SPF and DKIM aligned. Work down that list until every legitimate stream shows an aligned pass.
Once every real source aligns, and only then, you can safely tighten the policy. Moving from monitoring up to enforcement is its own staged job, covered in from quarantine to reject. The sequence never changes: align first, confirm in the reports, then enforce. Alignment is the work; enforcement is just the switch you flip once the work is done.