Why DMARC can fail even when SPF and DKIM pass: the alignment problem

Email headers may show SPF and DKIM as passing while DMARC still reports a failure, typically because of alignment issues. DMARC requires that at least one of SPF or DKIM passes for a domain matching the visible From address. SPF is evaluated against the envelope Return-Path, and DKIM against the d= domain in the signature, so a third-party sender using its own domains can pass both checks without aligning with the sender's domain. To diagnose this, the author recommends sending a test message and comparing the header.from, smtp.mailfrom, and header.d values in Authentication-Results. The suggested fixes are enabling custom domain authentication in the vendor's settings and optionally configuring a custom return-path, while keeping a monitoring policy in place. Because alignment must be checked for each sender and can break after configuration changes, the author advises reviewing aggregate reports regularly.