DKIM Alignment: How It Works & Why DMARC Still Fails

Your DKIM signature can verify perfectly and your email can still get rejected.

That sentence confuses a lot of smart operators, and it costs them real money. An outbound sequence stalls at 40 percent of its usual reply rate. An ecommerce flow that printed revenue for two years starts landing in spam. The ESP dashboard says everything is authenticated. The DMARC reports say otherwise.

The gap between those two realities is DKIM alignment: the check that decides whether a cryptographically valid DKIM signature actually counts toward DMARC. A signature can be perfect and still belong to the wrong domain, and once your DMARC policy moves to quarantine or reject, that mismatch stops being a technicality and starts deciding whether your mail reaches the inbox at all.

This guide explains DKIM alignment precisely, because this audience deserves precision. But every concept is anchored in deliverability outcomes: which failures cost pipeline, how to diagnose them from real headers and real DMARC reports, and how to fix them across a modern stack where marketing automation, CRM sequences, transactional mail, and outbound tools all send as your brand. If you want to test DKIM alignment before sending your next campaign, you can do that in minutes. First, let's make sure you know exactly what you're testing.

What DKIM Alignment Actually Means

DKIM alignment is a comparison between two domains:

1. The d= domain in the DKIM-Signature header: the domain that signed the message.
2. The visible From domain: the domain your recipients see in their mail client, defined by the message's From header.

If those two domains match (exactly, or at the organizational-domain level, depending on your DMARC configuration), the DKIM signature is aligned. If they don't match, the signature is unaligned, and it contributes nothing to your DMARC result no matter how valid it is.

This is the part most explanations skip: alignment is not the same thing as authentication. A message can carry a DKIM signature that verifies flawlessly, signed with a strong key, untampered in transit, and still fail DMARC because the signing domain has no relationship to the From domain. The signature answered "was this message signed and unmodified?" It never answered "was it signed by the brand the recipient thinks sent it?"

Alignment is the layer that binds the cryptography to the identity. Without it, DKIM proves integrity. With it, DKIM proves integrity on behalf of your domain, which is what mailbox providers actually care about.

DKIM Authentication vs. DKIM Alignment: The Distinction Everyone Misses

DKIM authentication verifies two things: the message body and signed headers were not modified in transit, and the signature was produced by whoever controls the DNS of the d= domain. That's it. DKIM on its own is completely indifferent to the From address.

This is by design. DKIM was built so any party in the delivery path could sign mail. Your ESP can sign with its own domain. A forwarding service can add its own signature. All of those signatures can be valid at once.

Which creates the trap: an email sent through a vendor platform often carries a valid DKIM signature for the vendor's domain, something like d=sendgrid.net or d=mailgun.org, while your From address says you@yourbrand.com. Authentication passes. The vendor's signature is real. But that signature vouches for the vendor, not for you.

Alignment closes that gap. DMARC only credits a DKIM pass when the signing domain and the From domain belong together. Think of it this way: authentication proves the letter is sealed. Alignment proves the seal belongs to the name on the envelope.

If you take one thing from this article, take the distinction. Nearly every confusing "DKIM passes but DMARC fails" ticket traces back to it.

Where DKIM Alignment Fits Inside DMARC

DMARC evaluates two identifiers against the From domain: SPF and DKIM. To pass DMARC, a message needs at least one of the two to both pass its own check and align with the From domain.

That "at least one" clause matters operationally:

• If SPF passes and aligns but DKIM is unaligned, DMARC passes.
• If DKIM passes and aligns but SPF is unaligned, DMARC passes.
• If both pass their checks but neither aligns, DMARC fails.

SPF alignment compares the From domain against the Return-Path domain (the envelope sender used for bounces). Many ESPs set the Return-Path to their own domain by default, which breaks SPF alignment out of the box. And forwarding routinely breaks SPF entirely, because the forwarding server's IP isn't in your SPF record.

That's why DKIM alignment tends to be the more durable pillar of the two. Cloudflare Radar's global measurements show DKIM passing on roughly 90.9 percent of observed mail versus about 80.2 percent for SPF. A signature travels with the message; an IP authorization doesn't. Senders who get DKIM alignment right survive forwarding, mailing lists, and Return-Path quirks that would sink an SPF-only strategy.

Strict vs. Relaxed DKIM Alignment (the adkim Tag)

Your DMARC record controls how strictly the domain comparison is applied, via the adkim tag:

• Relaxed (adkim=r): the default when the tag is absent. The d= domain and the From domain align if they share the same organizational domain, determined using the Public Suffix List. So d=mail.example.com aligns with a From address at example.com, and vice versa.
• Strict (adkim=s): the two domains must match exactly. d=mail.example.com does not align with example.com under strict mode, even though they're clearly related.

SPF has an equivalent tag, aspf, with the same relaxed and strict semantics applied to the Return-Path domain.

Relaxed mode is the right default for most senders because real infrastructure uses subdomains: a marketing platform signing as em.example.com, a transactional system signing as mail.example.com. Strict mode exists for cases where you want zero tolerance for subdomain ambiguity, and it becomes relevant for brands pursuing BIMI or operating in high-spoofing-risk categories. For a full walkthrough of every DMARC tag and what it controls, see DMARC adkim and aspf tags explained.

DKIM Alignment Examples: Pass vs. Fail Walkthroughs

Concrete headers make this click. Here are four scenarios you'll actually encounter.

Scenario 1: Exact match. Aligned under both modes.

From: Priya <priya@example.com>

DKIM-Signature: v=1; a=rsa-sha256; d=example.com; s=s1; ...

The signing domain and From domain are identical. This aligns under relaxed and strict alike.

Scenario 2: Subdomain signing. Aligned relaxed, unaligned strict.

From: Priya <priya@example.com>

DKIM-Signature: v=1; a=rsa-sha256; d=em.example.com; s=k1; ...

Same organizational domain, different exact domain. Under relaxed alignment (the default), this passes. Under adkim=s, it does not. This is the classic surprise when a team tightens alignment mode without auditing which subdomains their platforms sign with.

Scenario 3: Subdomain From address. Same rule, reversed.

From: Alerts <alerts@notify.example.com>

DKIM-Signature: v=1; a=rsa-sha256; d=example.com; s=s1; ...

Aligned under relaxed mode, unaligned under strict. Direction doesn't matter; strict requires an exact match either way.

Scenario 4: Vendor domain signing. Unaligned under both modes.

From: Priya <priya@example.com>

DKIM-Signature: v=1; a=rsa-sha256; d=vendormail.net; s=default; ...

The signature may verify perfectly. It still does nothing for your DMARC evaluation, because vendormail.net and example.com share no organizational domain. This is the default state of many ESP integrations until you configure custom signing.

Why DKIM Alignment Matters for Deliverability, Not Just Security

Most of what's written about alignment frames it as an anti-spoofing control. True, but incomplete, and it's why so many marketing and revenue teams tune out until something breaks.

Here's the operational reality. While your DMARC policy sits at p=none, misalignment is invisible: mail flows normally and the failures only show up in reports. The moment your policy moves to p=quarantine or p=reject, every message that fails DMARC gets filtered to spam or refused outright. For an outbound team, that's sequences silently dying mid-cadence. For an ecommerce brand, that's abandoned-cart and post-purchase flows evaporating from the inbox during your highest-revenue quarter.

And enforcement is no longer optional for volume senders. Google, Yahoo, and Microsoft now require bulk senders to authenticate with SPF, DKIM, and DMARC, and mail that can't demonstrate aligned authentication faces throttling and rejection at the gateway. Alignment has moved from best practice to table stakes.

There's also an inbox-placement upside. Industry measurement consistently associates properly authenticated, DMARC-aligned mail with stronger placement, with global inbox rates for aligned senders averaging around 87 percent and Gmail closer to 90. Mailbox providers reward senders whose identity signals are coherent.

One more stat worth sitting with: only about 12.8 percent of DMARC-enabled domains actually enforce a quarantine or reject policy. Most of the world has adopted DMARC without earning enforcement. The senders who master alignment are the ones who can enforce safely, and enforcement is where both the security value and the deliverability credibility live.

How to Check Whether DKIM Is Aligned

Diagnosis is a three-step habit.

1. Read the headers of a real delivered message. Send to a mailbox you control, open the full headers, and find the DKIM-Signature line. Compare the d= value to the domain in the From header. Same organizational domain: you're aligned under relaxed mode. Exact match: aligned under strict too. If you'd rather have this parsed and explained automatically, you can analyze your email headers instead of eyeballing raw text.

2. Check the Authentication-Results header. Receiving servers record their verdict there, including dkim=pass with the signing domain, and the DMARC result. This tells you what the mailbox provider concluded, not what your ESP claims.

3. Read your DMARC aggregate reports. The rua reports mailbox providers send you break down every source sending as your domain, with per-source DKIM results and alignment outcomes. This is the only view that covers your whole ecosystem, including senders you forgot existed.

Honest caveat: aggregate reports arrive as raw XML, one file per provider per day, and this is where most operators stall. Reading one report is doable. Reading hundreds per week across five sending platforms is not a human-scale job, which is why the monitoring section later in this guide matters as much as the checks themselves.

Why DKIM Passes but DMARC Still Fails

When a valid signature isn't rescuing your DMARC result, it's almost always one of three patterns.

Third-party platforms signing with their own domain. The most common cause by far. An ESP, CRM, survey tool, or billing system sends on your behalf but signs with its vendor domain because nobody completed the custom-domain setup step. Authentication passes for the vendor; alignment fails for you. Every new tool added to the stack is a fresh chance to reintroduce this.

Forwarding and mailing lists modifying content. DKIM survives forwarding as long as nothing touches the signed content. But mailing lists that add footers or rewrite subject lines, and security gateways that rewrite links, invalidate the signature. A large-scale study of 1.1 billion forwarded messages across 118 domains found that while about 73 percent of forwarding-related DMARC failures came from SPF breaking down, roughly 21 percent were DKIM signatures broken by content modification in transit. Forwarding damage is mostly an SPF story, but DKIM isn't immune.

Subdomain mismatches under strict alignment. If someone set adkim=s, every platform signing with a subdomain silently fell out of alignment. This one hides well because the same configuration passes cleanly the moment the policy returns to relaxed.

For a deeper troubleshooting reference covering key rotation, selector errors, and DNS issues, see common DKIM alignment and signing issues.

How to Fix DKIM Alignment Across Your Senders

Remediation follows the same shape for nearly every platform.

1. Configure custom DKIM signing for every third-party sender. Every serious sending platform lets you sign with your own domain instead of theirs. The pattern: the platform generates a key or CNAME set, you publish the records in your DNS, and the platform flips signing to d=yourdomain.com or a subdomain of it. In Google Workspace and Microsoft 365 this is generating and enabling DKIM for your domain in the admin console. In SendGrid and Mailgun it's domain authentication: publish their CNAMEs and signing moves from the vendor domain to yours.

2. Validate selectors after setup. A published key does nothing if the selector in the signature doesn't match a live DNS record. Send a test, read the s= and d= values in the signature, and confirm the corresponding TXT record resolves.

3. Confirm the signing domain matches or is a subdomain of your From domain. If your From is example.com and the platform signs as em.example.com, you're aligned under relaxed mode. Verify your DMARC record hasn't set adkim=s unless you've deliberately standardized on exact matches.

4. Re-verify after every DNS or platform change. Key rotations, ESP migrations, and domain reshuffles all reset your assumptions.

DKIM Alignment in Multi-ESP and Multi-Brand Environments

Single-domain, single-ESP advice covers maybe a third of real senders. The teams who feel alignment pain hardest run marketing automation, CRM sequences, transactional infrastructure, support tooling, and cold outbound simultaneously, often across several brands and domains. Agencies multiply that by every client.

In that world, alignment isn't a task. It's a portfolio. And portfolios need prioritization, because chasing every long-tail source at once means fixing nothing quickly. A lens that works:

• Fix high-volume, revenue-bearing streams first. Your ecommerce flows, your primary outbound domain, your transactional mail. A misaligned stream sending two million messages a month does more damage than ten misaligned tools sending a hundred each.
• Handle new platforms at onboarding, not after launch. Custom DKIM setup should be a required step in your new-tool checklist, verified with a pre-send test before the first real campaign goes out.
• Map every domain's senders explicitly. For each From domain in the portfolio, list every platform authorized to send as it and the d= domain each one signs with. Most multi-brand alignment incidents trace to a sender nobody remembered was still live.
• Deal with long-tail sources last, deliberately. The internal notification tool sending 40 messages a month either gets aligned, gets moved to a subdomain with its own policy, or gets retired.

The failure mode to avoid is treating each alignment fix as a one-off ticket. In a multi-ESP environment, alignment is a property of the whole system, and the system changes every time someone in another department signs up for a new tool.

Strict or Relaxed? Making the Right Alignment Decision

"Just use strict" is bad advice dressed up as rigor. The honest answer is a trade-off.

Strict alignment earns its keep when:

• You're implementing BIMI, where strict alignment expectations are part of the readiness picture.
• Your brand is a high-value spoofing target and you want no subdomain ambiguity in what counts as you.
• Your sending architecture is simple enough that every legitimate stream signs with the exact From domain, verified, not assumed.

Relaxed alignment is the safer operating mode when:

• Multiple platforms sign with different subdomains of your organizational domain, which describes most multi-ESP stacks.
• You're mid-migration or regularly onboarding new tools, where strict mode turns every incomplete setup into quarantined mail.
• Subdomain delegation is part of your architecture: marketing on one subdomain, transactional on another.

Two principles keep the decision honest. First, tighten only after your DMARC reports show sustained clean alignment from every legitimate source; the reports tell you when you've earned strict, guessing doesn't. Second, treat the choice as reversible and monitored rather than a one-time toggle. Alignment mode is a dial you manage against evidence, not a virtue you declare.

How to Monitor DKIM Alignment Over Time

Here's the uncomfortable truth that makes everything above a starting point rather than a finish line: alignment regresses. A DNS cleanup deletes a selector record. An ESP rotates keys. Someone connects a new sales tool with default vendor signing. IT enables strict alignment during a security review. None of these announce themselves, and every one of them shows up first as a quiet dip in your alignment rate and later as a loud drop in inbox placement.

What's worth watching:

• Alignment rate by sending source. Overall percentages hide problems. A 96 percent aligned domain can be hiding one fully broken platform inside the other four healthy ones.
• Trendlines, not snapshots. A source drifting from 99 to 91 percent aligned over two weeks is a signal worth investigating before it becomes a placement problem.
• Change-correlated dips. Alignment drops that coincide with a DNS change, a new integration, or an ESP migration tell you exactly where to look.

The difference between catching a regression in 24 hours and discovering it at month-end is measured in real sends: every campaign, sequence, and transactional burst that went out misaligned in between. This is precisely the layer where continuous deliverability monitoring earns its place in the stack, turning per-source alignment from a quarterly archaeology project into a live signal with alerts attached.

Frequently Asked Questions

What is the difference between DKIM authentication and DKIM alignment?

DKIM authentication verifies that a message was signed by the domain in the signature's d= value and wasn't modified in transit. DKIM alignment checks whether that signing domain matches the From domain your recipients see. A message can pass authentication with a valid vendor signature and still be unaligned because the signer isn't your domain. DMARC only credits signatures that are both valid and aligned.

Can DKIM pass but DMARC still fail?

Yes, and it's common. If the DKIM signature verifies but the d= domain doesn't align with the From domain, and SPF doesn't pass with alignment either, DMARC fails. The usual causes are third-party platforms signing with their own domains, content modification breaking signatures during forwarding, and subdomain mismatches under strict alignment.

What does the adkim tag do in a DMARC record?

The adkim tag sets how the DKIM signing domain is compared to the From domain. adkim=r (relaxed, the default) accepts a match at the organizational-domain level, so subdomains align with their parent domain. adkim=s (strict) requires an exact domain match. The aspf tag applies the same choice to SPF's Return-Path comparison.

Should I use strict or relaxed DKIM alignment?

Relaxed is the right choice for most senders, especially with multiple platforms signing under different subdomains. Strict fits brands with simple, fully verified signing architectures, high spoofing exposure, or BIMI plans. Move to strict only after your DMARC aggregate reports show every legitimate source aligning exactly, and keep monitoring after the change.

Why does DKIM alignment break when emails are forwarded?

Straight forwarding usually preserves DKIM, since the signature travels with the message. Breakage happens when the forwarding party modifies signed content: mailing list footers, subject tag insertions, or link rewriting by security gateways. In large-scale forwarding studies, most forwarding-related DMARC failures come from SPF breaking, with roughly a fifth caused by DKIM signatures invalidated through content modification.

Alignment Is a Signal You Manage, Not a Box You Tick

The senders who stay out of trouble don't treat DKIM alignment as a setup task completed once per platform. They treat it as an ongoing property of every system sending as their brand: verified before a new sender goes live, watched continuously afterward, and prioritized by revenue impact when something drifts.

That's the whole discipline in one sentence: know your signing domains, keep them bound to your From domains, and notice when the binding slips before your recipients' mailbox providers do.

Start with evidence rather than assumptions. Run your first deliverability test and see exactly how your DKIM alignment holds up across every sender before your next campaign goes out. Send with confidence.