Why DMARC can fail when SPF and DKIM pass
SPF and DKIM authenticate particular domains. DMARC also checks whether an authenticated domain aligns with the domain in the visible From address. A passing SPF or DKIM result alone does not establish that alignment.
An example
A message shows From: owner@example.com. SPF passes for bounce.example.net and DKIM passes for example.net. Those passing domains do not align with example.com, so the example can fail DMARC. These are invented domains and outcomes.
What to inspect before changing DNS
- Read the receiver’s DMARC result for the exact message.
- Compare the visible From domain with the SPF-authenticated envelope domain and DKIM signing domain.
- Check the domain’s alignment policy. Strict and relaxed alignment use different matching rules.
- Ask the sending service or administrator to configure an aligned authenticated domain, then send a direct test.
Do not assume misalignment is the cause when a report records only a failure and no alignment evidence. DNS snapshots collected later cannot recreate the original receiver’s evaluation.