SPF passes but DMARC fails
SPF authenticates a domain that does not align for DMARC.
Problem summary
SPF authenticates a domain that does not align for DMARC.
Symptoms
- spf=pass but dmarc=fail
- SPF authenticated domain does not align with From
- Headers show SPF on a tracking/mail-from subdomain
Possible causes
- Return-Path domain differs from From organizational domain
- aspf=s (strict) while only relaxed alignment would pass
- Relying on SPF alone while alignment is broken — DKIM also missing
How to diagnose
- Compare RFC5321.MailFrom domain to RFC5322.From domain
- Check DMARC aspf and org-domain alignment rules
- See whether DKIM alignment could pass instead
How to fix
- Align MAIL FROM with the From domain (or use a custom Return-Path)
- Prefer aligned DKIM (d= matching From) so DMARC can pass without SPF alignment
- Only loosen aspf after understanding spoofing trade-offs
How to verify
- dmarc=pass with spf aligned and/or dkim aligned
- Authentication-Results shows the aligned identifier
Prevention
- Design identity (From + Return-Path + DKIM d=) before go-live
- Test DMARC, not only SPF, in staging
When to escalate
- Production mail is failing for a material share of recipients after remediation attempts