dmarc=fail" despite dkim=pass and spf=pass

TL;DR

DMARC does not reward a bare pass. It requires SPF or DKIM to pass AND align with the domain in the From header. The usual cause here is relaxed alignment failing anyway: mail sent From your domain but authenticated under a vendor domain, or a subdomain From with authentication only on the parent. Compare the From domain against the SPF MAIL FROM domain and the DKIM d= domain in the headers, then align one of them.

"dmarc=fail" despite dkim=pass and spf=pass

Use this when

• Authentication-Results show spf=pass and dkim=pass but dmarc=fail on legitimate mail.
• A vendor or gateway sends for your domain and DMARC suddenly fails after enforcement.

Not for this skill when

• SPF itself returns fail or softfail. Fix the SPF record first.
• DKIM returns fail or neutral. Fix signing before alignment.

Steps

1. Open a failing message and copy the full Authentication-Results header, noting spf, dkim and dmarc lines. Verify: all three verdicts are visible for the same message.
2. Extract the three domains: the From header domain, the SPF authenticated domain, and the DKIM d= value. Verify: the three domains are written down side by side.
3. Check alignment mode in your DMARC record: aspf and adkim default to relaxed, so subdomains align, but strict mode requires an exact match. Verify: you know whether relaxed or strict applies.
4. If neither authenticated domain aligns, fix the sender: use your own domain in MAIL FROM for SPF alignment, or sign DKIM with d= set to your From domain instead of the vendor domain. Verify: the chosen fix aligns at least one identifier.
5. Send a fresh test message through the same path and re-read Authentication-Results. Verify: dmarc=pass appears on the new message.

Variant phrasings

dmarc pass requires alignment not just spf and dkim pass

The alignment explanation phrasing a searcher uses after reading the header.

spf and dkim pass but dmarc fail relaxed alignment

The mode-specific variant when a subdomain or vendor domain is involved.

Compatibility: RFC 7489 DMARC, Google and Microsoft 365 inbound checking, any sender publishing a DMARC record.

Why it happens

SPF authenticates the envelope sender and DKIM authenticates the signing domain. Neither was designed to match the visible From domain. DMARC adds that binding because phishing abuses exactly the gap: a message can pass both checks while impersonating a From domain it never proved control of.

Edge cases / pitfalls

• A subdomain From with SPF on the parent aligns under relaxed mode but fails under strict mode. Check aspf before changing senders.
• Forwarded mail often keeps DKIM alignment and loses SPF alignment, so the surviving aligned identifier decides the result.
• Multiple DKIM signatures are common: DMARC passes if any one signature aligns and passes.

Provenance

Resolved from the public thread: https://vectle.com/posts/pst93pSson6jy1eAzIugoIbw