SPF, DKIM and DMARC can all show green in your sending tool while DMARC alignment fails. Alignment means the domain that passed authentication matches the domain in your From address. If it does not, receivers can treat the mail as unauthenticated, however green the dashboard looks.
Here is the checklist I use, in order.
What does DMARC alignment actually require?
DMARC compares your visible From domain with two identifiers. RFC 7489 defines them:
- SPF alignment uses the domain in the RFC 5321 MailFrom (the Return-Path), not the From header.
- DKIM alignment uses the
d=domain of a DKIM signature that verifies.
A message passes DMARC when at least one of SPF or DKIM passes and the identifier it passed on aligns. Authentication alone is not enough. Google's sender requirements say the same for bulk senders: the From domain must be aligned with either the SPF domain or the DKIM domain. Microsoft's page for the 5.7.515 bounce asks for the same.
| Mode | What counts as aligned | Example |
|---|---|---|
| Relaxed (default) | Same organizational domain | d=example.com aligns with news.example.com |
| Strict | Exact domain match | The same example fails |
The mode is set with aspf and adkim in your DMARC record, as dmarc.org lists.
The checklist
Run it per sending domain, on a real delivered message, not on the DNS panel.
- Read the headers first. Send to a Gmail account you control, open "Show original", and look at the SPF, DKIM and DMARC lines. "PASS" on SPF with a different domain next to it is the signature of a misaligned pass.
- Check the DKIM
d=domain. If your sending tool signs with its own domain, DKIM passes but does not align. You want a signature whered=is your sending domain. Most tools and mailbox providers have a step to publish their DKIM key under your domain. - Check the Return-Path. If it is the tool's domain, SPF passes for them and not for you. Either set a custom return-path domain on your domain, or rely on DKIM for alignment. One aligned pass is enough.
- Check that every signing path is yours. If mail goes through a forwarding or relay service, SPF breaks because the forwarder's IP is not in your record. DKIM usually survives forwarding, which is why a DKIM that signs with your domain is the safer foundation.
- Check for a second SPF record. Two SPF records on one domain is a permanent error, so SPF fails. Merge them into one.
- Check the DMARC record syntax. A typo in
_dmarccan mean there is no record at all.v=DMARC1; p=noneis a valid start. - Check each domain, not just one. I have seen DKIM silently fail on a third of a batch because of one copy-paste error in a DNS panel, on domains the dashboard reported as healthy. That story is in why your cold email lands in spam.
- Re-test after every DNS change. DNS propagation delays make it easy to test too early and conclude the fix did not work.
What does a misaligned pass look like?
This is the pattern that confuses people most, so here it is in a table. The From domain in all rows is yourbrand.com.
| SPF result | DKIM result | DMARC result | Why |
|---|---|---|---|
pass, Return-Path bounce.tool.com | pass, d=tool.com | fail | Both passed, neither on your domain |
pass, Return-Path yourbrand.com | none | pass | SPF aligned |
| fail | pass, d=yourbrand.com | pass | DKIM aligned, one is enough |
pass, Return-Path mail.yourbrand.com | none | pass in relaxed, fail in strict | Same organizational domain, not an exact match |
The last row is the only reason to think about strict mode. Cold email setups often send from lookalike domains with subdomains for the return-path, so relaxed alignment is what keeps them passing.
How should I roll out the DMARC policy?
Start with p=none so you can see reports without affecting delivery, as Microsoft's example does. RFC 7489 describes p=none, quarantine and reject as the three policies, and Google accepts a policy of none for bulk senders. Moving to a stricter policy on a sending domain is a decision about spoofing protection, not a deliverability fix, so I do it only after I have confirmed that every legitimate sender for that domain aligns. For a throwaway sending domain used for cold email, that usually means a clean p=none; for your main company domain, plan it separately and never put a cold email tool on it.
What about the tracking domain?
People often blame the tracking domain for alignment, and that is a myth. The tracking domain rewrites links and hosts the open-tracking pixel. It does not enter the SPF or DKIM comparison. It does matter for something else: a shared tracking domain means your links carry other senders' reputation. I cover that choice in plain text, open tracking and custom tracking domains.
The order I fix things in
When several things are wrong at once, fix in this order, because each step makes the next one visible:
- Make sure a DMARC record exists, so you get a DMARC verdict in the headers.
- Make DKIM sign with your own domain. It survives forwarding, and one aligned pass is enough.
- Make SPF clean: one record, the right includes.
- Only then look at return-path alignment, which is a bonus once DKIM is aligned.
- Re-test with a message to Gmail and to Outlook.com, and read both sets of headers.
I stop at the first step where DMARC passes in both, then move on to the reputation checks. There is no prize for aligning SPF as well once DKIM already carries the pass, though doing both is more robust if one breaks.
Where this advice stops working
Passing alignment gets you through the door; it does not get you to the inbox. Google also says to keep spam rates in Postmaster Tools below 0.30%, which no DNS record can fix. After alignment, the remaining steps are placement tests, domain age, warmup, bounce rate and volume, in the order laid out in the deliverability audit. If you spread the load across many domains, how many inboxes you need tells you how many records you have to get right.
If a Google account is being suspended rather than filtered, that is a different problem, covered in when Google suspends your cold email inboxes.
I keep notes like these on my blog.