SPF, DKIM, and DMARC are often displayed as three green checkmarks, which hides the most important distinction between them. SPF authenticates a sending path for the SMTP envelope domain. DKIM authenticates a cryptographic signature for the signing domain. DMARC looks at the domain the user sees in the From header and asks whether at least one passing authentication identity aligns with it.

That last comparison—alignment—is why a message can show “SPF pass” and “DKIM pass” yet still fail DMARC.

Follow one message through the three identities

Imagine a customer sees:

`From: invoices@example.com`

The SMTP envelope-from might be:

`bounce@mailer.vendor.net`

The DKIM signature might contain:

`d=example.com; s=invoice1`

SPF can pass for `mailer.vendor.net`, but that domain does not align with `example.com`. DKIM can pass for `example.com`, which does align. DMARC therefore has an aligned passing mechanism and can pass.

If the vendor instead signs `d=vendor.net`, both SPF and DKIM may remain technically valid while neither identity aligns with `example.com`. DMARC fails.

This is why you need the domains from the headers, not merely a pass/fail summary.

SPF alignment uses the mail-from domain

SPF checks whether the connecting server is authorized by the domain used for the SMTP mail-from or return path. A third-party platform often controls that domain by default.

To make SPF useful for DMARC, many platforms offer a custom return path such as `bounce.example.com`. Under relaxed alignment, that subdomain can align with `example.com`. The vendor’s setup instructions should tell you whether a custom bounce domain is supported and which DNS records it requires.

Forwarding can break SPF because the forwarder’s IP may not be authorized by the original sender’s domain. That is one reason relying on SPF alone is fragile.

DKIM alignment uses the signing domain

DKIM alignment compares the signature’s `d=` value with the visible From domain. A vendor can sign every message correctly with its own domain and still provide no aligned DKIM identity for your brand.

Look for a “custom DKIM,” “domain authentication,” or “sending domain” feature in the provider. The result you want is a passing signature whose `d=` is your From domain or an aligned subdomain.

DKIM often survives forwarding better than SPF because the signature travels with the message, provided intermediaries do not alter signed content in a way that breaks validation.

Relaxed versus strict alignment

DMARC defaults to relaxed alignment. For DKIM, relaxed mode generally allows the signing domain and From domain to share the same organizational domain. For SPF, the mail-from domain can similarly use an aligned subdomain.

Strict alignment requires a closer exact-domain match. Tightening to strict mode can be appropriate in a controlled environment but creates more operational constraints. Do not switch because “strict sounds safer” without testing every legitimate system.

How to inspect alignment in Gmail

Send a production message to a Gmail test account and choose “Show original.” The summary often lists SPF, DKIM, and DMARC, while the raw headers provide the exact domains and selectors.

Build one row per mail stream: - visible From domain; - SPF result and authenticated mail-from domain; - DKIM result and `d=` domain; - DMARC result; - sending application.

Repeat for newsletters, invoices, support messages, CRM outreach, and employee mail. If a row passes DMARC only through DKIM, note that dependency. If that provider later stops signing correctly, there may be no aligned SPF fallback.

Why alignment matters more in modern sender rules

Gmail’s requirements for senders above its bulk threshold include SPF and DKIM authentication, DMARC, and alignment of the visible From domain with either the SPF or DKIM domain. Yahoo publishes comparable expectations for bulk senders. That makes alignment an operational requirement, not just a security-theory detail.

For a small business below those thresholds, the same configuration reduces ambiguity and makes troubleshooting far easier. The question becomes concrete: “Which identity failed?” rather than “Why does Gmail hate us?”

A useful final test is to deliberately list every provider that can send as your brand and point to the mechanism that gives it DMARC alignment. If you cannot do that, the domain’s authentication architecture is not fully documented.

Handle multiple brand domains as separate identities

A company that sends as `brand-a.com` and `brand-b.com` needs authentication aligned to each visible From domain. Passing DKIM for `brand-a.com` does not make a message from `brand-b.com` aligned merely because both brands belong to the same company. The same is true for SPF return paths.

Inventory sending identities by visible From domain × platform. For every pair, record which aligned SPF path and which aligned DKIM path are expected. This catches a common migration problem: a team copies a working campaign into a second brand, changes the From address, but leaves the original brand's custom DKIM or return-path configuration in place.

Test each brand independently after DNS or platform changes. If one sending platform serves several domains, keep selectors and return paths clearly named so operations staff can tell which identity a received header is supposed to authenticate.