Understanding your email results

Why SPF can pass while DMARC fails

SPF can pass for a domain belonging to your email service. DMARC also checks whether an authenticated domain matches the domain in your message’s From address. This relationship is called alignment.

First, check the message’s overall DMARC result. An SPF alignment warning alone does not mean DMARC failed.

See which domains to compare

An illustrative example

The domain that passed SPF can be different.

The From address is the sender address you see in the message. SPF can check a different domain used by the sending service.

Example only · not a live message
Domain in the visible From address	`northstar.example`
Domain that passed SPF	`sender-service.example`
DKIM result	No passing signature
DMARC result	Fail

SPF passed for the sending service’s domain, but that domain does not align with northstar.example. In this example, there is no passing DKIM signature to satisfy DMARC either.

DKIM can provide the aligned result.

DKIM is a signature added by the sending service. If a valid DKIM signature used northstar.example, this example could pass DMARC even with the same unaligned SPF result.

Do the domains have to be identical?

DMARC has two alignment modes. Relaxed alignment accepts domains with the same organizational domain. Strict alignment requires an exact domain match.

For example, if northstar.example is the organizational domain, mail.northstar.example and northstar.example can align in relaxed mode. They do not match in strict mode. The DMARC policy’s aspf and adkim settings control the SPF and DKIM modes; the default is relaxed.

Do not change these settings just to remove a warning. First establish which domains and results the receiving service evaluated. Read the DMARC alignment definitions.

Your next step

Check the receiving service’s message results.

Use the original message as received by the destination mailbox. Its message headers contain technical details added during delivery, including authentication results.

Your email app may call this “Show original,” “View source,” or “View message details.” If you cannot find it, ask the person who manages that mailbox.

For the same message at the same receiving service, find these results. In Microsoft’s Authentication-Results header, the fields are named as shown below.

Visible From domain: The domain in the sender address. header.from
SPF result and domain: Whether SPF passed, and the domain it checked. spf and smtp.mailfrom
DKIM result and signing domain: Whether a signature passed, and which domain signed it. dkim and header.d
Overall DMARC result: Whether the receiving service found a passing, aligned result. dmarc

There may be several authentication results from different stops along the delivery route. If you are unsure which one belongs to the receiving service, ask your administrator to identify it.

Adding a service to your domain’s SPF record does not change the domain that service uses when sending. Follow the sending service’s instructions after you know which result needs attention.

A separate check

Need to inspect the public records too?

Taverlo can show the DMARC policy and SPF record published for a domain. It does not inspect the message or determine why that message failed.

Check public SPF and DMARC records

You’ll get a dated public-record finding. If the check finds no record issue, return to the message’s authentication results; that does not establish that the message passed DMARC.

Return to the message evidence above

Protocol reference: RFC 9989: DMARC. For the setup sequence, read the SPF, DKIM, and DMARC guide.