Why SPF, DKIM, and DMARC Alignment Matters in HTML Emails

You send an email with both HTML and plain-text versions. It looks perfect. The recipient opens it. But it lands in spam—again. Why? Because even if SPF and DKIM pass, misaligned headers in multipart/alternative emails can still break DMARC.

Think of SPF, DKIM, and DMARC as a three-stage security checkpoint. You pass the first two, but a mismatch in the "from" header between HTML and plain-text parts can make the third fail. It’s not about the content—it’s about consistency.

When alignment fails, inbox placement drops. Spam filters notice the inconsistency and treat it as a signal of potential abuse. That’s how a legitimate message gets flagged.

Key takeaways

  • SPF and DKIM can pass even when DMARC fails due to header misalignment in multipart/alternative emails
  • Only one part of a multipart/alternative email needs misaligned headers to trigger DMARC failure
  • Ensuring the "From" domain matches in both HTML and plain-text parts is essential for consistent authentication

What Is Multipart/Alternative Email Structure, and Why Does It Break Authentication?

When an email includes both HTML and plain-text versions, it uses the multipart/alternative MIME type — a standard method to deliver the same content in multiple formats. This structure causes issues for email authentication because DKIM signs each part separately, but only one can align with the domain in the From header during DMARC checks, leading to alignment failures even when everything else is technically correct.

How Multipart/Alternative Emails Work

Most modern emails contain both an HTML version and a plain-text fallback. The multipart/alternative type ensures that email clients can render the appropriate version based on user settings or device capability. For example, a user with plain-text-only preferences sees the raw version; someone with full rendering support gets the styled HTML layout.

Each version — HTML and plain text — lives in its own MIME part. This is where things get tricky: DKIM applies a cryptographic signature to each part individually. The signature includes a dkim-signature header that identifies the domain used to sign it. But only one of those domains can align with the From header domain during DMARC evaluation.

Why Alignment Fails Without Careful Setup

DMARC requires that either the From domain or the DKIM-signing domain aligns with the sender's domain. In multipart/alternative emails, if the HTML and plain-text parts are signed by different domains — which happens with some email services or outdated configurations — DMARC sees the failure and may reject the message.

That’s why it’s critical that both DKIM-signed domains match the From domain, or that the sending infrastructure applies the same signing domain to both parts. A common misstep is using different domains for signing HTML and text versions, especially when using third-party tools that don’t manage alignment automatically.

For more on how modern email delivery works, see RFC 2046, which defines the multipart/alternative content type. You can find the specification at tools.ietf.org/html/rfc2046.

Even if your message passes SPF and DKIM, alignment failure in a multipart/alternative setup can still trigger DMARC rejection. That’s why testing your email delivery path — including how multiple parts are signed — is essential before large-scale sends.

If you’re validating sender reputation or testing inbox placement across real inboxes, consider using MailTester’s inbox placement tester to check how your message appears and authenticates in live environments.

How SPF, DKIM, and DMARC Interact in Real-World Email Flow

You send a multipart/alternative email with HTML and plain text. SPF checks if the sending IP is authorized. DKIM signs the headers and body using a private key, with the public key in DNS. DMARC evaluates both results, requiring alignment with the From domain to pass. If either SPF or DKIM fails, DMARC can quarantine or reject the message. This flow ensures authenticity, but misalignment breaks trust — even if the content is correct.

How Each Protocol Functions in Practice

Let’s clarify what each protocol actually does, especially when handling mixed-content emails.

Protocol Validates How It Works Key Requirement
SPF Sender IP address Checks if the sending IP is listed in the domain’s TXT record as an authorized sender. Must match the envelope sender (Return-Path), not the From header.
DKIM Message integrity Uses a cryptographic signature over selected headers and the body, verified using a public key in DNS. Signature must cover the From header and body, and the selector must match the DNS record.
DMARC Alignment and policy enforcement Uses SPF and DKIM results, but only counts a pass if both are aligned with the From domain. Requires alignment (strict or relaxed) between the From domain and the domains in SPF or DKIM.

For multipart/alternative emails, DKIM signs the entire message body, including both HTML and plain text parts. This helps preserve integrity across formats. But the key challenge arises when the From domain does not align with the SPF or DKIM domains — even if the email is technically valid, DMARC can still reject it, leading to delivery failure.

According to RFC 7052, alignment is required for DMARC to enforce policy. Misalignment is common in transactional email flows involving third-party services, especially when headers are rewritten or the sending IP changes.

For example, if you send via a service like SendGrid, SPF may pass under their domain, but DKIM will use your domain. Without strict alignment, DMARC fails — and your email goes to spam or is rejected, even if the content is legitimate.

That’s where real-time verification helps. Before sending at scale, run your addresses through a tool like MailTester’s email checker to catch invalid or misaligned recipients. If a domain has no SPF or DMARC, it’s a red flag — you may not know your email is vulnerable to spoofing.

Properly setting up SPF, DKIM, and DMARC isn’t optional. It’s the foundation of deliverability. Use MailTester’s inbox placement test to verify how your messages appear in real inboxes — including how they handle alignment checks across providers like Gmail and Outlook.

What Is Alignment, and Why It Matters in Multipart/Alternative Emails

You need domain alignment between the From header and the DKIM signature in multipart/alternative emails — especially when the HTML part is being rendered. If the From domain is yourcompany.com but DKIM signs the HTML part with mailer.yourcompany.com, that’s a misalignment, even if the signature is valid. This breaks DMARC, reducing deliverability. You’re not just sending mail; you’re building trust.

What Defines Alignment in Mixed Content Emails?

In multipart/alternative messages, the email contains both plain text and HTML versions of the same content. When the recipient client renders the HTML version, the DKIM signature on that part must align with the From domain. Otherwise, DMARC will fail, and many inbox providers will treat the message as suspicious — even if SPF and DKIM are technically correct.

For example, if your From header says [email protected], the DKIM signature must either be on company.com or a subdomain that explicitly aligns under it — mail.company.com is acceptable, but mailer.service.com is not. The key is that the signing domain must be under the same root as the From domain.

Why This Makes or Breaks Deliverability

Even with valid DKIM and SPF, lack of alignment is a common cause of DMARC failures. According to RFC 7672, alignment is a hard requirement for DMARC to pass. Without it, messages may be quarantined or blocked — especially by Gmail and Yahoo.

Let’s say your ESP signs the HTML part with its own domain. If that domain doesn’t align with your From address, even a 99% clean list won’t help. You need to verify that your email infrastructure, including your ESP and email templates, signs the HTML part with the correct, aligned domain.

Use MailTester’s email checker to validate a single address and see if alignment issues show up in real delivery conditions. For bulk campaigns, test the full delivery flow with inbox placement testing to catch alignment problems before they hit your audience.

Alignment isn’t about strict identity — it’s about consistency. When the From address says one thing and the DKIM signature says another, the inbox provider sees a disconnect. That’s a red flag, not a technical glitch. Fix it, and you remove a major hurdle to inbox placement.

Common Pitfalls When Using DKIM with Multipart/Alternative HTML Emails

You're sending multipart/alternative emails with HTML and plain-text parts, and your DKIM signature is failing—even though you think you've signed everything. The real issue is often subtle: signing only the plain-text part while leaving the HTML part unsigned, using mismatched domains for DKIM and From, or placing the DKIM-Signature header in the wrong section of the message. These misalignments break DKIM validation and can harm your sender reputation, even if your email content is clean.

Incorrect Signing Scope

  • Signing only the plain-text part while the HTML part remains unsigned causes DKIM validation to fail. Most mail servers check both parts, and if either is unsigned but expected to be, the signature is invalid.
  • DKIM must sign the entire message body, including both the text and HTML parts. If only one part is signed, the signature does not match the content.
  • Use consistent signing across all parts to ensure validation succeeds across all receiving servers.

Domain Mismatch Between DKIM and From Header

  • Using a subdomain like mailer.company.com in your DKIM selector but having the From: header as company.com breaks alignment. This is a common configuration error.
  • DKIM and DMARC depend on domain alignment. If the signing domain (where the DKIM-Signature points) does not match the From domain, DMARC will fail even if DKIM passes.
  • Ensure the DKIM selector domain matches your visible From domain. For example, if From is [email protected], your DKIM-Signature header should be signed from dkim._domainkey.company.com, not a subdomain.

Improper DKIM Header Placement and Duplication

  • Placing the DKIM-Signature: header in the wrong part of the email—such as inside the HTML body or after the headers—causes validation to fail.
  • The DKIM-Signature: header must be in the email's header section, before the body, and only once per message.
  • Duplicating the header across both text and HTML parts leads to parsing errors. Some receivers reject messages with duplicate DKIM-Signature headers, assuming a malformed or malicious payload.
  • Validate your headers using tools like MXToolbox’s DKIM validator or RFC 6376 (DKIM) to catch misplacements early.

These mistakes are easily missed in automated systems. If you're sending bulk emails, run your message through a real-time email checker before sending—test whether your headers and content are aligned properly. Use MailTester’s inbox placement tool to see how your email performs in real inboxes with alignment checks baked in. Catching misalignments early prevents delivery failures and protects your sender reputation.

Step-by-step: How to Fix Alignment in Multipart/Alternative HTML Emails

You can fix SPF/DKIM/DMARC alignment in multipart/alternative emails by ensuring the From header domain matches the DKIM signing domain, signing only the actual parts that are sent, using a single DKIM-Signature header in the correct section, keeping Message-ID and Date consistent across parts, and validating everything with a real verification API like MailTester before sending.

1. Match the From domain to the DKIM signing domain

Make sure the domain in the From header exactly matches the one used in the DKIM-Signature header’s d= tag. If your From is example.com but your DKIM key signs with mail.example.com, alignment fails. This is a common misconfiguration that triggers DMARC failures, even if the email reaches the inbox. The alignment requirement for SPF and DKIM in DMARC is strict: both must align with the From domain (RFC 7001).

2. Apply DKIM only to the parts you actually send

DKIM must be applied to the actual content that is delivered—typically the HTML part in multipart/alternative emails. If your system sends both plain-text and HTML, but only one is used based on recipient preferences, sign only the part that’s sent. If both are sent, you can sign both, but only one DKIM-Signature header should be included, and it must be placed in the correct part. Using multiple signatures or signing the wrong part leads to alignment errors.

3. Use a single DKIM-Signature header, placed correctly

Each email must have exactly one DKIM-Signature header. It should be added to the MIME part that contains the actual content (usually the HTML part). The header must list a consistent signing domain (d=) and must not be duplicated across parts. Misplaced or duplicated headers break alignment and are flagged by DMARC evaluators.

4. Verify Message-ID and Date consistency

These headers must be identical across all parts of the email. Using different Message-ID or Date values in different parts can cause confusion in email clients and spam filters. The same values should appear in both the HTML and plain-text sections. A mismatch can lead to alignment issues or trigger spam detection.

5. Test with a real email-verification API

Even if your headers look correct, real-world alignment checks are needed. Use a verification API like MailTester to test how your email performs under actual delivery conditions. MailTester checks SPF, DKIM, DMARC, and alignment in real environments, providing a detailed report before you send to live recipients. Test with the email checker to validate individual addresses, or use the bulk verification tool for larger lists.

DMARC alignment is not optional. It’s a core part of modern email authentication. By following these steps, you reduce the risk of delivery failure and build sender reputation. For more on email standards, see RFC 7001 and RFC 6376.

How to Verify SPF and DKIM Alignment Using MailTester

You can verify SPF and DKIM alignment in multipart/alternative emails by sending a test message through MailTester’s inbox-placement tool or checking individual addresses via the real-time API. The results will show whether SPF and DKIM pass, fail, or misalign, and whether DMARC policy enforcement is active. This ensures your email’s technical foundation matches recipient expectations—critical for inbox delivery.

Test Your Email’s Alignment in Real-Time

  1. Send a test email using MailTester’s inbox-placement tester. This simulates delivery to major inboxes (Gmail, Outlook, Apple Mail) and checks how your email’s headers fare under real-world conditions, including SPF, DKIM, and DMARC alignment. Test your message before sending to the full list.
  2. Use the real-time verification API to check individual addresses. For high-volume sends, send each email address through the API to receive domain-level diagnostics, including SPF pass/fail, DKIM validation status, and DMARC policy enforcement. Integrate the API directly into your sending workflow.
  3. Review the report for alignment status. Look for explicit fields like “SPF alignment status” or “DKIM alignment status.” A mismatch here means your email will likely be marked as suspicious, even if both SPF and DKIM technically pass. This happens when the domain in the From header doesn’t match the authorized domain in either SPF or DKIM.
  4. Check for “DKIM alignment failure” or “SPF alignment mismatch”. These terms appear if the domain used in the From (sender) header does not align with the domain reported in the DKIM signature or SPF record. For example, if your From: is @yourcompany.com but the DKIM signature uses @mail.yourcompany.com, alignment fails. This often happens with third-party email services that use different subdomains.
  5. Fix alignment issues before mass sending. Correct the misalignment by either using a consistent domain in your From header and DKIM signing, or adjusting your SPF and DKIM records to authorize the full chain of domains. Misalignment is a common reason for emails ending up in spam folders, even with valid authentication.

Why This Matters in multipart/alternative Emails

In emails with both HTML and plain-text parts, alignment is not affected by content type—only by the header domains. But because these emails often include links and branding from different subdomains, alignment failures creep in more easily. Ensuring alignment across all components prevents subtle authentication gaps that filtering systems like Gmail or Microsoft Defender detect. RFC 7672 outlines the precise rules for DKIM alignment in multi-part messages, particularly around the use of different domains in the From field and signatures.

MailTester’s reports clearly separate these checks, so you’re not guessing whether the issue is SPF, DKIM, or alignment. You get a plain English verdict and a clear path to fix it—no guesswork. This level of visibility is essential for maintainable sender reputation and consistent inbox placement.

What to Do If Your Multipart/Alternative Email Still Fails DMARC

If your multipart/alternative email still fails DMARC despite correct headers, the issue likely lies in misaligned SPF, DKIM, or DNS configuration. Double-check that your SPF record includes the sending IP, your DKIM signature uses the correct selector and public key published in DNS, and that the DKIM-signing domain matches the From header domain. Use tools like MxToolbox or Spamhaus to validate DNS records, then retest using MailTester’s bulk verification process on your full list to confirm resolution.

Verify Core Authentication Settings

  • Check your SPF record to confirm it includes the sending IP address. A missing or incorrect SPF entry causes authentication to fail even if DKIM passes.
  • Ensure your DKIM selector (e.g., default or mailtester) is correctly defined and its public key is published in DNS under the proper selector._domainkey.domain.com CNAME or TXT record.
  • Verify that the domain used in the DKIM-signature header (in the h= field) matches the From header domain exactly, including subdomains. Mismatches break alignment.

Validate DNS and Retest with Real Tools

  • Use MxToolbox (https://mxtoolbox.com/) to check your SPF, DKIM, and DMARC TXT records in real time. It will highlight syntax errors or missing entries.
  • Run a DMARC alignment check via Spamhaus (https://www.spamhaus.org/) or a similar public tool to confirm that both SPF and DKIM are aligned with the From domain, as required by DMARC policy.
  • After fixing configuration, retest your full email list using MailTester’s bulk verification process (https://mailtester.com/email-list-verify/) to catch any lingering issues before sending.

DMARC alignment is strict: it requires both SPF and DKIM to pass and align with the From domain. Even a single misconfigured part can trigger failure. Let’s be clear—this isn’t about guesswork. It's about testing each layer in isolation and confirming behavior at scale. If you’re using multipart/alternative emails with HTML, ensure your signing process is consistent across both parts. The From domain must not change between the plain-text and HTML versions. And yes, you must check DNS in the same domain context where the email originates.

Why You Need an Email-Verification SaaS to Prevent Authentication Breakage

You can have flawless SPF, DKIM, and DMARC alignment, but sending to invalid or outdated email addresses still risks inbox deliverability. These bounces damage your sender reputation, triggering filters and possibly blacklisting—even if your email structure is technically perfect. A real-time email-verification SaaS like MailTester checks every address before you send, helping maintain clean lists and consistent authentication performance.

Invalid Addresses Break the Chain

Even one bad address can disrupt your sending reputation. If your campaign hits a disposable domain, a catch-all mailbox, or an expired inbox, the resulting bounce may be flagged as abusive—especially if repeated. This affects your overall sender score, which email providers use to assess trustworthiness. SPF and DKIM signatures can be valid, but if the recipient doesn’t exist, the delivery fails, and the feedback loop still counts against you.

Prevent Breakage Before It Happens

MailTester’s 98.9% accuracy identifies invalid, outdated, or risky addresses before you send. This cleaning step ensures your authentication stack—SPF, DKIM, and DMARC—is only deployed on valid, deliverable recipients. The result? Fewer bounces, better inbox placement, and a healthier sender reputation. It’s not enough to get the headers right; you must also send to addresses that exist.

Integration with tools like SendGrid, Mailchimp, and HubSpot lets you automate verification right before your email campaign executes. You’re not waiting for bounces to learn your list is stale—you’re catching problems in real time. And because your purchased credits never expire, you can run continuous checks without budget pressure.

For testing multipart/alternative emails—where HTML and plain text versions must both resolve cleanly—this kind of pre-send validation is even more critical. One broken component (like a malformed HTML part) can trigger delivery issues, but even worse, a single invalid recipient can trigger a chain reaction of reputation damage.

For more, explore how MailTester helps keep your email infrastructure clean and secure: check your entire list or integrate real-time verification into your workflow. The goal isn’t just technical correctness—it’s delivering consistently, reliably, and with integrity.

Final Recommendation: Align SPF, DKIM, and DMARC Before Every Email Send

SPF, DKIM, and DMARC only work when their domains align across all email components. Use the same From domain in every message to avoid mismatches that trigger spam filters.

Ensure every email, especially multipart/alternative types with HTML and plain-text parts, carries a DKIM signature that matches the From domain. A mismatch — even in the HTML part — breaks alignment and hurts deliverability.

Test and verify

  • Simulate real inbox conditions using inbox-placement testing before sending to large lists.
  • Use a dedicated verification tool to test alignment, domain validity, and deliverability risk across major inboxes.

Sources

Keep reading

Ready to put this into practice? MailTester verifies emails with 98.9% accuracy — start with 100 free verifications.

Frequently asked questions

Does every email part need to be signed with DKIM?

No. Only one part (usually the HTML version) needs to be signed. Sign both only if required by your email service provider, but ensure domain alignment is preserved.

Can I use different domains for From and DKIM with DMARC?

Only if you’re using DMARC policy with 'p=none' or 'p=quarantine'. For 'p=reject', alignment is required. Using different domains will block delivery on strict policies.

How do multipart/alternative emails affect spam filtering?

They are standard and acceptable, but improper signing or misalignment in the headers can trigger spam filters, especially on high-volume senders.

What does 'DKIM alignment failure' mean in MailTester?

It means the domain used in the From header does not match the domain in the DKIM-Signature header, violating DMARC alignment requirements.

Can SPF and DKIM both pass while DMARC fails?

Yes. This happens when SPF or DKIM pass but the domains don’t align with the From domain. DMARC evaluates alignment, not just pass/fail status.

Should I sign both HTML and plain-text parts of multipart emails?

Only if your email service provider requires it. Most services sign the HTML part. Sign only one part unless your system dictates otherwise.

How do I know if my email is properly aligned?

Use tools like MailTester to test individual addresses or campaign-level deliverability. Look for alignment success in the results, not just SPF/DKIM pass.

Is DMARC alignment mandatory for all senders?

No, but strict DMARC policies (p=reject) are common among domains with strong security practices. Alignment ensures reliability for high-volume senders.

Can role accounts (e.g. sales@) pass SPF and DKIM alignment?

Yes, if the From domain matches the SPF and DKIM signing domain. But role accounts are often flagged by filters — verify using MailTester's list hygiene features.

Does using SendGrid or Mailchimp affect DKIM alignment?

Yes. These services sign with their own domains. You must align the From header with the signing domain or use custom DKIM keys to maintain alignment.

How often should I test my email authentication setup?

Test before every major campaign and periodically during domain transitions. Use MailTester’s API to automate this in your workflow.

Do disposable email addresses affect SPF alignment?

They don’t directly affect SPF, but they can trigger spam traps and low reputation. Use MailTester to remove disposable domains from your list.