Why do your authenticated emails still get blocked?

You’ve set up SPF and DKIM. Your email tool says everything’s green. Yet some messages still end up in spam folders—or vanish entirely. That’s not a fluke. It’s misalignment.

Authentication isn’t just about having the right headers. It’s about making sure the domain in your email’s From field matches the domain used in SPF and DKIM checks. If it doesn’t, even perfectly configured tech can fail.

Think of it like a driver’s license that says “John Doe” but the car’s registration lists “Jane Doe.” The car is legal, but the mismatch raises red flags. Same with email: mismatched domains trigger filtering engines, even when SPF and DKIM validate.

Canary sends and SPF/DKIM alignment testing catch these subtle failures before they cost you deliverability. We’ll show you how.

Key takeaways

  • SPF and DKIM only prevent some blocks—alignment between From domain and authentication domains is required for inbox delivery.
  • Even with valid SPF/DKIM, emails may be blocked if the From domain doesn’t align with the domains used in authentication headers.
  • Canary sends simulate real email flows to test alignment and authentication behavior in practice, not just theory.

What are canary sends and why do they matter for email authentication?

Canary sends are test emails sent to monitored, known-good inboxes to validate how your domain’s authentication (SPF, DKIM, DMARC) behaves in real-world conditions. Unlike basic delivery tests, they track the full journey from SMTP handshake to inbox placement, revealing if your email setup is aligned and trusted by major providers. You’re not just checking if mail gets sent—you’re verifying it lands, authenticates, and avoids being flagged or quarantined.

How canary sends go beyond basic delivery checks

Most delivery tests only confirm the server accepted your message. Canary sends do more: they simulate real user behavior—like opening the email or checking your domain in a real mailbox. This lets you catch authentication flaws that wouldn’t surface with simple SMTP probes. For example, a message might pass basic delivery but fail DKIM alignment, or arrive with inconsistent SPF results across recipients.

Let’s say your SPF record allows one sending IP, but your bulk provider uses another. A canary send will show whether the email is flagged as unauthorized by the receiving server—even if the message technically “delivers”. That’s why they matter: they expose subtle, real-world misconfigurations that hurt sender reputation and inbox placement.

What canary sends reveal about SPF/DKIM alignment

SPF, DKIM, and DMARC don’t work in isolation—they must align correctly across all layers. Canary sends expose issues like domain mismatch (e.g., SPF validates the sending domain, but DKIM signs a different one), or DMARC policies that are too strict or too weak. For example, if DMARC only applies to “d=yourbrand.com” but your messages use “mail.yourbrand.com”, alignment fails.

DKIM signing scope mistakes—like signing only the body while skipping headers—can break alignment. Canaries catch these because they’re received by providers that validate every component. You can see exactly where alignment breaks and fix it before sending to real users.

Tools like MailTester’s inbox placement test simulate these real-world paths using monitored inboxes across Gmail, Yahoo, Outlook, and others. For a deeper audit, pairing it with a real-time API check at the verification API helps validate individual addresses across these same conditions. It’s not about guessing—your authentication is tested under real routing rules.

The foundation of deliverability is trust. SPF, DKIM, and DMARC are the technical expressions of that trust. Canary sends are the only way to test whether your domain’s authentication actually works when it matters most: when the first real user sees your message.

For teams managing large email lists, running canary sends as part of a pre-send workflow is a proven way to reduce bounces, avoid spam filters, and maintain sender reputation. It’s the difference between assuming your setup works and knowing it does.

SPF, DKIM, and DMARC: their roles in email authentication

You can’t secure email delivery without SPF, DKIM, and DMARC working together. SPF checks if the sending server is authorized for the domain. DKIM adds a digital signature to verify the message wasn’t altered. DMARC tells receiving servers what to do if either SPF or DKIM fails—like rejecting or quarantining the email. When all three are aligned, they form a trusted authentication chain that major inboxes rely on.

SPF: Authorizing the sending server

SPF lets you list which servers are allowed to send emails on behalf of your domain. When a message arrives, the receiving server checks your SPF record to verify the sending IP matches. If it doesn’t, the email may be flagged as suspicious. Misconfigured SPF records are common and can cause deliverability issues—especially when using third-party email services like Mailchimp or SendGrid.

DKIM: Ensuring message integrity

DKIM works by cryptographically signing parts of the email—typically the headers and body. When the receiving server verifies the signature using your public key, it confirms the message wasn’t modified in transit. This is critical for preventing spoofing. A missing or invalid DKIM signature often results in emails being marked as spam or rejected outright.

DMARC acts as the enforcement layer. It builds on SPF and DKIM results and tells the receiver what action to take when authentication fails. You can set it to monitor (no action), quarantine (flag as spam), or reject (block the message). Setting it to reject is the strongest position, but only viable once SPF and DKIM are properly set up and aligned.

Alignment is key: SPF and DKIM must agree on the "from" domain. For example, if your email says it’s from [email protected], both SPF and DKIM should validate against that domain—not a subdomain or a different one. Misalignment undermines the entire chain, even if SPF and DKIM pass individually.

MailTester’s inbox placement test checks for proper SPF, DKIM, and DMARC alignment across real inboxes. It’s one of the few tools that can simulate how an email will be treated by Gmail, Outlook, and other major providers. You can verify your full authentication stack with a single test at inbox-tester.

For ongoing validation, use our bulk verification to catch invalid or poorly configured addresses before you send. Or integrate our real-time API to validate addresses at point of entry. These tools help ensure your sender reputation stays clean and your messages remain deliverable.

For more, see RFC 7208 (DMARC), RFC 6376 (DKIM), or use tools like MxToolbox to audit your existing records. Consistent setup is just as important as correct configuration.

What is SPF/DKIM alignment and why is it critical?

SPF and DKIM alignment ensures that the domain in the email’s "From" header matches the domain used in the email’s SPF check (envelope-from) and DKIM signature (signing domain). When these don’t match—say, you send from example.com but your email is signed by mailer.example.com—alignment fails. Even if SPF and DKIM pass individually, many providers like Gmail and Outlook will still treat the email as suspicious or spam if alignment fails, especially under strict DMARC policies.

How alignment works in practice

Let’s say you send an email using a third-party service. The "From" header says "[email protected]", but the server that sends it uses a different domain—like "mailer.yourcompany.com"—for SPF and DKIM. That’s a mismatch. Even if both SPF and DKIM checks pass, the email fails alignment. This happens often with marketing platforms or email templates that default to a different sending domain than the one shown to users.

Mail providers use alignment as a trusted signal. According to the RFC 7672, DMARC relies on alignment to prevent spoofing and phishing. If your domain enforces DMARC with a policy of "reject" or "quarantine", mismatched alignment means your email might not reach the inbox—even if it’s legitimate.

Why this matters for deliverability

If your email fails alignment, it’s at higher risk of being flagged or blocked, even if all technical checks pass. Major gateways like Gmail and Outlook have built detection systems that look for alignment as part of spam filtering. An unaligned email is more likely to be sent to spam or dropped entirely, especially if your sender reputation is already weak.

Testing this early is key. You can use tools like MailTester’s inbox placement test to send a canary email and see how your full authentication stack performs in real inboxes. It checks SPF, DKIM, DMARC, alignment, and even content signals—giving you a full deliverability score before you send to a whole list.

Even if you’re using a legitimate service, misalignment can happen without you realizing it. Tools like MailTester’s bulk verification can help identify problematic addresses and catch alignment issues in your sender domain setup before they hurt your reputation.

How to test SPF/DKIM alignment with canary sends

You can test SPF/DKIM alignment by sending a canary email from your verified domain to a monitored inbox, then checking that the envelope sender (SPF) and DKIM signature both authenticate under the same domain. Confirming this alignment ensures recipients see your message as trustworthy and reduces the risk of inbox filtering. Use a tool like MailTester’s inbox placement tester to simulate real-world delivery across major providers.

Step-by-step SPF/DKIM alignment verification

  1. Send a test email from your domain to a dedicated test mailbox. Use a dedicated address or an email verification service to track results without affecting your main inbox. This simulates a real outbound send and allows you to inspect headers and authentication results.
  2. Confirm SPF passes in the envelope sender (RETURN-PATH). The sending server’s IP must be authorized in your domain’s SPF record. You can check this using tools like MXToolbox or by examining the email header for a passing SPF result in the Authentication-Results field.
  3. Verify DKIM signs with the correct domain and selector. The DKIM-Signature header must include your domain and a selector that matches your DNS record. Tools like RFC 6376 define how DKIM signatures work, but actual validation requires matching the public key in DNS.
  4. Check that the 'From' domain aligns with both SPF and DKIM domains. If your SPF authorizes example.com and DKIM signs example.com, the 'From' header must use the same domain. Misalignment here is a common reason for emails to land in spam.
  5. Test the full chain across multiple providers using a real-time tool. Send a test mail through your setup and use MailTester’s inbox placement tester to see how your authentication stack performs on Gmail, Outlook, and other major services. This reveals issues you won’t catch with just header inspection.

Why alignment matters for deliverability

Even if SPF and DKIM pass individually, misalignment breaks the chain. Many email providers check for alignment before accepting messages. A lack of alignment, especially in the 'From' domain, can trigger filtering—even if the technical checks succeed. Testing with canary sends ensures you’re not just passing validations but actually building sender reputation.

What happens when SPF and DKIM are not aligned?

Even if SPF and DKIM both pass their individual checks, your email can still fail DMARC because DMARC requires alignment between the domains in SPF and DKIM. A mismatch means the email is rejected or quarantined, often landing in spam despite correct technical setup. This misalignment is a silent killer of deliverability and often goes unnoticed until reputation suffers or volume spikes trigger blocklists.

DMARC alignment is non-negotiable in modern email authentication

DMARC policies enforce alignment to prevent spoofing. SPF checks the sending domain from the envelope from address, while DKIM signs the header from address. If these domains don’t match, even a technically valid email fails DMARC. According to the DMARC specification (RFC 7483), alignment is required for policy enforcement, and many domains enforce strict alignment.

Let’s say you send from [email protected], but your SPF record allows mail from mailer.yourcompany.com. DKIM might sign with yourcompany.com as the selector, but if SPF uses a different domain, the alignment check fails. The email may pass SPF and DKIM individually, but DMARC sees the mismatch and blocks it.

Even slight discrepancies—like subdomains not matching—can trigger failure. A well-known example is using a dedicated sending domain (e.g. mailer.brand.com) for SPF while signing with brand.com in DKIM. Without alignment, the email is treated as unauthenticated.

Why canary sends make the difference

Without canary sends, alignment failures often go undetected during testing. You might test a single email, see it pass, and assume everything’s fine—only to find your bulk campaign flagged or suppressed later. That’s because alignment issues surface under volume, not small-scale testing.

Canary sends expose alignment problems before they cost you reputation. By sending a small, controlled test email from your system with actual sending patterns, you can catch misaligned SPF/DKIM configurations early. MailTester’s inbox placement tool simulates real-world delivery and flags alignment failures before you send to thousands.

Use inbox placement testing to validate full authentication chains—SPF, DKIM, and their alignment—under real-world conditions. This isn’t just about passing checks. It’s about ensuring your email reaches inboxes consistently, not just in spam folders.

How MailTester enables real-time canary send verification

You can test SPF, DKIM, and DMARC alignment in real time by sending canary emails to actual inboxes across Gmail, Outlook, Yahoo, and Apple Mail—without relying on third-party tracking pixels or delayed feedback. Each send is validated at every layer of the email delivery chain, with detailed results returned immediately, so you know exactly where authentication fails.

Testing across real inboxes, not just servers

Unlike tools that only check DNS records or simulate delivery, MailTester sends test emails to live user accounts at major providers. This means you’re testing the full email journey—from header authentication to inbox placement—using real infrastructure. The results reflect what your actual messages will experience, not a theoretical model.

Granular, actionable feedback on alignment

Every canary send returns a full breakdown of SPF, DKIM, and DMARC alignment status, not just a pass/fail. You’ll see which components passed, which failed, and why—such as mismatched domains in a DKIM signature or a missing SPF record. This level of detail helps you fix issues before they impact your sender reputation.

Authentication isn’t just about policy; it’s about real-world behavior. According to RFC 7001, DMARC alignment requires consistency between the "from" domain and the SPF or DKIM identifiers. MailTester checks that alignment across all layers—header from, envelope from, and DKIM signature—to ensure compliance with standard email validation rules.

Whether you’re verifying a single address or a full list, you can run these tests in real time through the real-time verification API or inbox placement tool. No external tracking tools or delay-prone analytics are needed. The system confirms whether the email reached the inbox and whether it passed authentication at the moment of delivery.

For teams managing bulk sends, this capability is critical. You can validate that your sender configuration aligns correctly for every recipient before hitting send. Use the bulk verification tool to run multiple canary sends at scale, ensuring consistent authentication performance across your campaigns.

When you integrate with platforms like Klaviyo, HubSpot, or SendGrid via our integrations, you can automatically test authentication before sending, reducing risk and improving deliverability. All verification credits last forever, so your testing remains flexible and cost-effective over time. You’re not just checking records—you’re testing reality.

Integrating canary send testing into your workflow

You can automate email authentication checks by sending small test messages before major campaigns using the MailTester API. This catches SPF/DKIM misalignment early, prevents inbox placement drops, and integrates with tools like SendGrid, Mailchimp, or Klaviyo to verify sender setup during onboarding. Run monthly canary sends to spot DNS or config drifts before they impact real sends.

Key steps to build in proactive validation

  • Use the MailTester Verification API to send test emails automatically before every bulk campaign or list upgrade.
  • Integrate with your ESP—SendGrid, Mailchimp, HubSpot, or Klaviyo—via webhooks or scheduled jobs to validate SPF/DKIM alignment during onboarding or after domain changes.
  • Schedule a monthly canary send from your main sending domain to detect subtle drifts in authentication setup, such as expired DKIM keys or outdated SPF records.
  • Correlate canary send results with inbox placement data from tools like MailTester’s inbox tester to spot early signs of delivery degradation before sender reputation is impacted.
  • Store test outcomes in a shared dashboard or internal log to track configuration stability over time—especially useful when infrastructure or team changes occur.

Why this works in practice

Authentication errors often go unnoticed until delivery drops. SPF and DKIM alignment issues can silently trigger filtering, even if the email technically "sends." A canary send is a light-weight, repeatable way to catch misconfigurations before a campaign ships.

According to RFC 7208 (SPF), alignment is a core component of email validation. When SPF and DKIM don’t align with the From domain, recipients may treat the message as suspicious—even if the sender is legitimate.

Let’s say your team updates your DMARC policy or migrates your email service provider. A monthly canary send will flag alignment mismatches immediately, letting you fix them without compromising deliverability. No more guessing if a change broke authentication.

Start with 100 free verifications at MailTester’s pricing page to test your setup. Use the integrated workflows to connect your email platform, and run a live canary send every 30 days to stay ahead of configuration drift.

The real-world impact: how alignment testing improves deliverability

Customers using canary sends with MailTester report a 30–45% reduction in bounce and quarantine rates, especially when sending to domains with strict DMARC policies like banks and government agencies. This isn’t theoretical—aligning SPF and DKIM correctly prevents subtle delivery failures that otherwise slip through unnoticed. You’re not just checking if an email is valid; you’re validating that your authentication actually works in the real world.

Why alignment matters most with tough domains

Domains like financial institutions and public agencies enforce DMARC policies that reject mail with misaligned SPF or DKIM. Even a single misalignment can result in quarantine or outright block. MailTester’s canary send feature simulates a real message and checks how the receiving server responds to your authentication setup. This proactive test identifies issues before you send to thousands of users—something traditional validation tools miss.

Without alignment testing, a message might pass basic syntax checks but still fail in production. For example, a message sent via your ESP might use a different “From” domain than the one listed in your SPF record. This mismatch triggers a DMARC failure, even if the email is legitimate. The result? Bounced or quarantined mail, even with high sender reputation. You can’t see this failure unless you test with a real-world canary.

Preventing reputation decay and blacklisting

Authentication drift happens. A change in your ESP, a shared IP, or a forgotten header can break alignment without your team noticing. Over time, this erodes your sender reputation. MailTester’s canary sends catch these problems early—before they cause mass delivery failure or trigger spam filters that flag you as inconsistent.

DMARC policies are designed to detect spoofing. If your authentication setup isn’t aligned, your message looks like it might be a phishing attempt. That’s why domains with strong enforcement often blacklist senders who fail repeatedly—even if the content is clean. Testing alignment before scaling your campaign avoids this trap.

Let’s be clear: you're not just verifying addresses. You’re validating your full delivery stack. That’s why we built inbox placement tests and real-time API checks into our platform. Use inbox placement testing to see how your message lands in real user inboxes, and integrate seamlessly with your workflow. Your reputation depends on it.

For detailed verification across your list, bulk verify your list with 98.9% accuracy. It’s not a magic fix—but it’s the only way to know your authentication works, down to the last byte.

What to do when a canary send fails authentication

If a canary send fails SPF, DKIM, or DMARC alignment, don’t panic. Start by checking the full authentication chain in the test report: verify SPF authorizes the sending IP, DKIM signs with a matching public key, and DMARC policies are correctly applied. Look for domain mismatches—especially between the 'From' address and the DKIM signing domain. Misalignment breaks alignment checks, often triggering inbox rejection.

Diagnose the failure with real logs

  1. Review SPF, DKIM, and DMARC results from the canary send report. These logs show exactly where the authentication chain broke. SPF checks if the sending IP is authorized. DKIM validates the message hasn’t been altered and the signature is legitimate. DMARC enforces policies based on SPF and DKIM outcomes.
  2. Check the 'From' domain against the DKIM signing domain. If your email says From: [email protected] but DKIM signs with a different domain (e.g., mail.company.com), alignment fails. The domains must match or be within a valid subdomain hierarchy.
  3. Ensure your SPF record includes all sending IPs and subdomains. Many campaigns use third-party services (e.g., SendGrid, Mailchimp) that rely on separate IP ranges. Missing a sending IP in SPF means SPF fails—even if DKIM passes. Use RFC 4408 as a reference for proper SPF syntax.
  4. Verify your DKIM selector and public key are correctly published in DNS. A mismatch here means DKIM verification fails. Use MXToolbox to test DNS records and confirm the key is visible and untruncated. The selector (e.g., default, dkim) must match the one used during signing.
  5. Update DNS records, wait 30–60 minutes, and retest. DNS changes take time to propagate. After updating SPF, DKIM, or DMARC, wait at least 30 minutes. Then, run another canary send via MailTester’s inbox placement tool to verify alignment now passes.

Alignment is not optional. It’s required by most major inboxes. Failure here often means emails land in spam or are blocked entirely. Fixing it starts with reading the logs—no guesswork. Use MailTester’s real-time API or bulk verification to validate addresses and catch issues early.

Authentication isn’t a checkbox. It’s a chain. Break one link, and the whole system fails.

You can’t trust a domain without alignment testing — even with perfect SPF

Email authentication isn’t just about deploying SPF, DKIM, and DMARC. It’s about ensuring they align correctly across all sending contexts.

A single misalignment between the from domain and the SPF or DKIM domain can trigger a DMARC failure — even if both mechanisms individually pass validation.

Why alignment testing matters

  • SPF validates the sending IP, but only applies if the envelope sender aligns with the header From domain.
  • DKIM signs the message content using a selector and domain — but only if the signing domain matches the From domain.
  • DMARC enforces both, making alignment the final gatekeeper of inbox placement.

MailTester’s canary sends simulate real-world delivery to major providers, verifying not just validity, but also alignment behavior across Gmail, Outlook, and Apple Mail.

With 98.9% accuracy, our results reflect actual outcomes — not theoretical compliance. Our in-app AI assistant interprets complex test data and recommends actionable fixes based on observed delivery patterns.

Sources

Keep reading

Ready to put this into practice? MailTester verifies emails with 98.9% accuracy — start with 100 free verifications.

Frequently asked questions

What is a canary send in email deliverability?

A canary send is a test email sent to monitored inboxes to verify authentication, routing, and inbox placement before sending to a production list.

How does SPF/DKIM alignment affect email deliverability?

Misalignment between the From domain and SPF/DKIM domains causes DMARC failures, which often result in emails being quarantined or rejected by major providers.

Can I test SPF/DKIM alignment without sending real emails?

No — alignment must be validated in actual email flow. Tools like MailTester simulate real sends across providers, which is the only way to capture alignment behavior at scale.

How does MailTester test SPF/DKIM alignment?

MailTester sends canary emails to real inboxes and analyzes the full authentication chain, including SPF, DKIM, and DMARC alignment, across major email providers.

Do I need to set up DNS records to use MailTester for alignment testing?

Yes — your DNS records (SPF, DKIM, DMARC) must be properly configured. MailTester verifies their actual behavior in real email flow.

Can canary sends detect changes in DMARC policies?

Yes — if a policy changes to reject or quarantine, canary sends will show immediate changes in delivery or alignment behavior.

What if my SPF passes but DKIM fails alignment?

Alignment fails if the DKIM signing domain doesn’t match the From domain. This causes DMARC policy enforcement, even if SPF passes.

How often should I run canary sends?

Run them before major campaigns, after DNS changes, or monthly to detect configuration drift before it impacts deliverability.

Can I use MailTester to test alignment with third-party platforms like SendGrid?

Yes — MailTester integrates with SendGrid, Mailchimp, HubSpot, and Klaviyo to test alignment during outbound sends, regardless of the sending platform.

Does MailTester provide detailed reports on alignment failures?

Yes — you get real-time results showing pass/fail status for SPF, DKIM, and DMARC, along with alignment status and recommendations for fixes.