DKIM passes but DMARC fails
DKIM validates but signing domain does not align for DMARC.
Problem summary
DKIM validates but signing domain does not align for DMARC.
Symptoms
- dkim=pass but dmarc=fail
- DKIM d= domain does not align with From
- ESP signs with its own domain while From is yours
Possible causes
- Signing domain (d=) is the vendor domain
- Strict adkim with organizational mismatch
- Custom From without custom DKIM domain setup
How to diagnose
- Compare DKIM d= to the From domain / org domain
- Check DMARC adkim mode
- Confirm whether SPF alignment could still save DMARC
How to fix
- Configure the ESP to sign with your domain (custom DKIM)
- Publish selectors under your domain and use matching d=
- Align From with a domain you can sign, if brand allows
How to verify
- dmarc=pass with aligned DKIM
- Authentication-Results shows header.d aligning to From
Prevention
- Require custom-domain DKIM in ESP onboarding checklists
- Reject go-live if only vendor-domain signatures exist
When to escalate
- Production mail is failing for a material share of recipients after remediation attempts