Fix DMARC Misalignment Between From and Authenticated Domain

What's happening

DMARC alignment, defined in RFC 7489 Section 3.1, requires that at least one of SPF or DKIM authenticate a domain that aligns with the From header. SPF alignment compares the envelope-from (Mail From / Return-Path) domain to the From header. DKIM alignment compares the d= signing domain to the From header. Either one passing aligned is sufficient for DMARC.

Misalignment is the most common cause of dmarc=fail despite individual passes of spf=pass or dkim=pass. The receiver sees the authentication succeed but the domain it authenticated does not match what the user sees as the sender. From DMARC's perspective, the message is not authenticated for the visible sender.

Two flavors exist. SPF misalignment occurs when ESPs use their own bounce domain (envelope-from sendgrid.net, From: example.com). DKIM misalignment occurs when the ESP signs with d=sendgrid.net rather than d=example.com. Both produce dmarc=fail and bounce under p=reject.

Why it matters

Strict DMARC reject policies bounce all misaligned mail. Transactional notifications, marketing campaigns, and user-facing alerts vanish overnight when enforcement is enabled and alignment is broken.

Mailing-list and forwarded mail are particularly affected. SPF nearly always breaks after forwarding (envelope rewritten by the forwarder). Without aligned DKIM, DMARC fails on every forwarded message.

The problem is invisible at p=none — reports show dmarc=fail but mail still flows. When the team enables enforcement, the breakage is sudden and severe, often generating support tickets within hours.

Common causes

• ESP envelope-from is the ESP's domain (return.sendgrid.net) rather than a customer subdomain.
• DKIM signs with d=mailgun.org or d=amazonses.com instead of d=example.com.
• From header uses a subdomain (mail.example.com) but DMARC adkim=s requires exact match.
• Custom SMTP relay strips DKIM signatures and does not re-sign.
• Mail goes through multiple hops and one of them rewrites the From header.

Detect this on your site

Run a quick scan with the Email Checker. The tool surfaces this exact issue with the records and context needed to apply the fix below.

How to fix it

1. 1

   Read Authentication-Results headers on a real message

   Send a test through your production sending path to a Gmail account. Click Show Original. Find Authentication-Results and read spf=... smtp.mailfrom=, dkim=... header.d=, and dmarc=... reason=. The reason field reveals exactly which alignment check failed.

2. 2

   Configure custom return-path at the ESP

   In SendGrid Sender Authentication, Mailgun Domain Verification, Amazon SES Custom MAIL FROM Domain, configure a subdomain like bounces.example.com or mail.example.com as the envelope-from domain. Publish the required CNAME or MX records the ESP provides.

3. 3

   Configure customer-domain DKIM at the ESP

   Same vendor flow — "Authenticate domain" or "Add sending domain". The ESP generates DKIM records (CNAMEs to their managed key infrastructure or TXT keys). Publish them in DNS. After verification, all outbound mail will sign with d=example.com.

4. 4

   Decide on adkim and aspf strictness

   Default DMARC alignment is relaxed (adkim=r aspf=r), allowing subdomain mail to align with the apex. Most senders should keep relaxed. Use strict (adkim=s aspf=s) only when you specifically must forbid subdomain authentication from passing for the apex.

5. 5

   Validate alignment with a test message

   Send another test and read the headers. Authentication-Results should now show dmarc=pass with reason=aligned. Both spf=pass with mailfrom=bounces.example.com and dkim=pass with header.d=example.com (or em1.example.com) will satisfy alignment under relaxed mode.

6. 6

   Confirm in DMARC aggregate reports

   After 24-48 hours, open the next aggregate report. Every legitimate sending source should show dkim_aligned=true or spf_aligned=true. Any rows still misaligned point to a specific sender that needs further configuration.

Example

; Custom return-path subdomain (SendGrid example)
em1.example.com. IN CNAME u123.wl.sendgrid.net.
em1.example.com. IN MX 10 mx.sendgrid.net.

; Custom DKIM CNAMEs
s1._domainkey.example.com. IN CNAME s1.domainkey.u123.wl.sendgrid.net.
s2._domainkey.example.com. IN CNAME s2.domainkey.u123.wl.sendgrid.net.

; DMARC with relaxed alignment (default)
_dmarc.example.com. IN TXT "v=DMARC1; p=quarantine; rua=mailto:dmarc@example.com; adkim=r; aspf=r"

Custom return-path and DKIM CNAMEs deliver aligned authentication for both SPF and DKIM legs of DMARC.

Related fixes