Aligning SPF and DKIM with your domain

For DMARC to pass, it is not enough that SPF and DKIM simply pass - they must also align with the domain in your visible From address. Understanding alignment is the key to a working DMARC setup.

What alignment means:

• SPF alignment: the domain used in the envelope/return-path matches (or is a subdomain of) your From domain.
• DKIM alignment: the domain in the DKIM signature (the d= value) matches your From domain.

DMARC passes if either SPF or DKIM passes and is aligned. So a message can pass raw SPF but still fail DMARC if the SPF domain does not match your From domain.

Common alignment problems:

• Sending through a third-party platform that signs with its domain, not yours - fix by verifying your domain with them so DKIM uses d=yourdomain.ae.
• Using a From address on a different domain than the one that authenticates.

How to get alignment right: always send from your own domain, enable DKIM signed with your domain, and for third-party senders add their SPF include and set up domain-based (branded) DKIM. Then check a DMARC report or mail-tester to confirm alignment shows "pass".

This is the single most common reason DMARC unexpectedly fails for legitimate mail. If your reports show alignment failures you cannot explain, send them to us and we will help - WhatsApp +971 58 553 6767.