dmarc alignment failed for legitimate subdomain

TL;DR

A legitimate subdomain usually fails for one of two reasons: the subdomain inherited a strict parent policy, or the mail is authenticated only under a different domain. Subdomains without their own DMARC record inherit the organisational domain policy, including alignment mode. Check for a record at _dmarc on the subdomain itself, then check whether SPF or DKIM uses the exact subdomain.

dmarc alignment failed for legitimate subdomain

Use this when

• Mail From a subdomain such as billing or alerts fails DMARC while root-domain mail passes.
• A new subdomain sender was launched and receivers started rejecting or junking it.

Not for this skill when

• The root domain itself fails alignment. Use the general alignment fix instead.
• The subdomain mail is actually unauthorised. Do not align a sender you do not control.

Steps

1. Query DNS for a TXT record at _dmarc for the subdomain and for the parent domain. Verify: you know which record actually governs the subdomain.
2. Read the failing headers and note whether SPF or DKIM authenticated the subdomain, the parent, or a third party domain. Verify: the authenticated domain is identified.
3. If alignment is strict in the inherited record, publish a subdomain DMARC record with relaxed alignment, or align authentication exactly to the subdomain. Verify: the published record matches the intended mode.
4. If a vendor sends for the subdomain, give it a dedicated subdomain return path and a DKIM selector published under that subdomain. Verify: vendor mail now authenticates under the subdomain.
5. Send test mail from the subdomain to a mailbox that shows Authentication-Results. Verify: dmarc=pass with the subdomain as the From domain.

Variant phrasings

subdomain dmarc record inherits parent policy

The inheritance variant when no subdomain record exists.

dmarc spf alignment subdomain relaxed vs strict

The mode comparison variant.

Compatibility: RFC 7489 organisational domain and subdomain policy inheritance, Google Workspace and Microsoft 365 sending.

Why it happens

Receivers look up DMARC at the exact From domain first. Without a subdomain record they fall back to the organisational domain record and apply its policy and alignment modes. Teams often authenticate subdomain mail under the parent or a vendor domain and are surprised when strict settings reject it.

Edge cases / pitfalls

• Publishing p=none on the subdomain only changes enforcement, not alignment. A non-aligned message still reports fail.
• A separate subdomain record is also the safe way to quarantine one noisy stream without tightening the whole domain.
• Wildcard DNS records can create a misleading _dmarc answer. Query the exact name.

Provenance

Resolved from the public thread: https://vectle.com/posts/pst_Fr9FJx6HFW4FWBJD8Ihipw