Fix DKIM Not Aligned with From Domain (DMARC Failing)

What's happening

DMARC alignment, defined in RFC 7489 Section 3.1, requires that at least one of SPF or DKIM authenticate a domain that aligns with the visible From header. For DKIM, alignment means the d= tag in the DKIM-Signature header matches (or shares an organizational domain with) the From: domain.

A common misconfiguration is DKIM signing using the ESP's domain rather than your own. SendGrid signing with d=sendgrid.net, Mailgun signing with d=mailgun.org, or Amazon SES signing with d=amazonses.com all produce dkim=pass at receivers — but DMARC sees d=sendgrid.net!= From: example.com and reports dmarc=fail.

Once the customer enables DMARC enforcement (p=quarantine or p=reject), every unaligned DKIM signature plus failing SPF means the message bounces. The problem is invisible while DMARC is in p=none — you see dkim=pass and assume everything works — until enforcement is enabled and traffic falls off a cliff.

Why it matters

Strict DMARC reject policies bounce all unaligned mail. For B2B SaaS sending transactional notifications, this means password resets, login codes, and receipts vanish overnight when enforcement is enabled.

Without aligned DKIM, mail that traverses mailing lists or alias forwarders has no surviving DMARC alignment — SPF breaks on rewrite, and unaligned DKIM does not save it. Customers using corporate aliases or.edu forwarding bounce.

Brand impersonation defense weakens. Aligned DKIM is the strongest signal that mail truly came from your organization. Unaligned DKIM is no better than no DKIM for DMARC-checking receivers.

Common causes

• ESP defaulted to signing with their own domain instead of generating customer-domain DKIM.
• Customer-domain DKIM was set up but not enabled for the specific sending stream.
• Subdomain From: (mail.example.com) but DKIM signs with d=example.com — these align by default but only if relaxed mode is set.
• Strict DMARC alignment (adkim=s) configured but DKIM signs a parent domain.
• Mail relay through a third party that re-signs with their own domain and strips the original signature.

Detect this on your site

Run a quick scan with the Email Checker. The tool surfaces this exact issue with the records and context needed to apply the fix below.

How to fix it

1. 1

   Read a real message's DKIM-Signature header

   Send a message through your production path to a Gmail account, click Show Original, and find the DKIM-Signature header. Note the d= value. Compare to the From: domain. If they differ at the organizational level, alignment is broken.

2. 2

   Enable customer-domain DKIM at the ESP

   In SendGrid Sender Authentication, Mailgun Domain Verification, Postmark Sender Signatures, etc., add example.com (your domain) as an authenticated sending domain. The ESP generates a CNAME or TXT record for you to publish.

3. 3

   Publish the DKIM CNAME or TXT records

   Most ESPs use CNAMEs that point to their managed key infrastructure (s1._domainkey.example.com CNAME s1._domainkey.u123.wl.sendgrid.net). Publish exactly as the ESP provides at TTL 3600.

4. 4

   Verify alignment by sending a test

   After DNS propagation (5 min for TTL 300, up to 1 hour for TTL 3600), send a test through the ESP and Show Original in Gmail. The DKIM-Signature should now show d=example.com (or a subdomain like em1.example.com that organizationally aligns).

5. 5

   Check DMARC alignment in headers

   Look for Authentication-Results:... dmarc=pass with reason=aligned. If it still says dmarc=fail with reason=unaligned, the d= and From: organizational domains do not match — re-check the ESP configuration.

6. 6

   Decide on adkim relaxed vs strict

   DMARC has adkim=r (relaxed, default — subdomain.example.com aligns with example.com) and adkim=s (strict — must match exactly). Most senders should leave adkim=r. Use adkim=s only if you specifically need to forbid subdomain DKIM from aligning with the apex.

Example

; SendGrid customer-domain DKIM via CNAME (typical setup)
s1._domainkey.example.com.    IN CNAME s1.domainkey.u12345.wl.sendgrid.net.
s2._domainkey.example.com.    IN CNAME s2.domainkey.u12345.wl.sendgrid.net.

; Resulting DKIM-Signature on outbound mail
; DKIM-Signature: v=1; a=rsa-sha256; d=example.com; s=s1; ...

Two CNAMEs delegate DKIM key management to SendGrid while keeping d= aligned with your domain.

Related fixes