Why is your email failing DMARC when SPF and DKIM are aligned?

You’re sending from a trusted subdomain, SPF and DKIM both pass, and yet your email still fails DMARC with a permfail. You’ve checked the DNS, run the tests, confirmed the signatures—so what’s wrong?

DMARC doesn’t care only about technical validity. It checks whether the domain in the From header aligns with the domains used in SPF and DKIM. Even if both are correctly configured, misalignment triggers a permfail—regardless of passing technical checks.

Think of it like a door with two locks: one for the sender’s identity (SPF), one for the message’s integrity (DKIM). DMARC is the bouncer at the door. If the person claiming to be the owner (From) doesn’t match either the sender’s name (SPF) or the message’s seal (DKIM), they get turned away—even if both locks work.

Key takeaways

  • DMARC permfail occurs when the From domain does not align with SPF or DKIM domains, even when both signatures are technically valid.
  • Common causes include sending from a subdomain without delegating SPF to the parent domain or using third-party sending services with mismatched DKIM domains.
  • Alignment requires that the From domain matches either the SPF sender domain or the DKIM signing domain at the organizational level (i.e., the domain in the d= tag).

What does DMARC permfail mean in plain terms?

DMARC permfail means your email failed the domain authentication check because the sender's domain and the authenticated domains (SPF or DKIM) don't align, even if SPF and DKIM individually passed. It’s not a spam tag—it’s a technical signal that the message might not be from whom it claims to be, which can trigger filtering. If the receiving domain’s policy is set to reject, the message is blocked.

Why alignment matters, even when SPF and DKIM pass

Let’s say your company sends from [email protected]. SPF might pass because the sending IP is authorized. DKIM might pass because the signature is valid. But if the SPF check says the email came from mail-server.yourcompany.com while the From domain is yourcompany.com, that’s a mismatch. DMARC cares about this alignment—it checks whether the domain in the From header matches the domain used in SPF or DKIM. No match? Permanent failure.

DMARC policies like reject or quarantine are applied based on this alignment. Even if all authentication checks pass individually, a permfail can result in your email going to spam or getting dropped entirely. This is especially common when using third-party services like SendGrid, Mailchimp, or HubSpot, which often use their own domains for sending but set the From address to yours.

For example, if you send from [email protected] via a platform that signs with sendgrid.net, your DKIM will pass, and SPF might pass if you've included SendGrid’s IPs. But unless you’ve aligned the sending domain to match the From address (a practice called "domain alignment"), you’ll still get a permfail. This is why tools like MailTester’s bulk verification or verification API help catch these issues before you send.

How to fix a permfail

Fixing a permfail starts with understanding your email infrastructure. If you use a third-party email service, ensure the From address aligns with either the SPF or DKIM domain. For example, if DKIM signs with sendgrid.net, your From domain should also be sendgrid.net—or you must set up proper alignment via SPF or DKIM with your own domain.

For organizations sending at scale, using tools with real-time DMARC analysis—like MailTester’s inbox placement testing—can show you how your messages are treated in real inboxes. This helps reveal if permfail conditions are leading to poor deliverability.

More information on how DMARC works is available in the official RFC 7483, which defines DMARC evaluation logic. The core point remains: alignment is how DMARC protects users from spoofed messages. When alignment fails, even with valid SPF and DKIM, the result is a permfail.

How does DMARC alignment work in practice?

DMARC alignment ensures that the domain in the email’s From header matches the domains used in SPF and DKIM checks. For SPF, the sending domain must be in the same organizational hierarchy as the From domain (e.g., mail.sender.com aligns with sender.com). For DKIM, the signing domain in the DKIM-Signature header must match the From domain or a subdomain. If either check fails, DMARC policy enforcement kicks in, often resulting in a PermFail.

SPF Alignment: Matching the Envelope Sender to From

When a sender uses SPF, the domain in the SMTP MAIL FROM (envelope sender) must belong to the same organizational domain as the From header. For example, if the From is [email protected], the MAIL FROM must be [email protected] or another subdomain under company.com. If it’s mail.sender.com instead, SPF alignment fails even if the record is technically valid.

Let’s say you’re sending from a third-party platform like SendGrid. If the MAIL FROM is [email protected] but the From header says [email protected], SPF alignment fails. DMARC checks this mismatch and may reject the email. This is common with misconfigured shared sending systems.

DKIM Alignment: Signing Domain vs. From Domain

DKIM alignment checks whether the domain in the DKIM-Signature header matches the From domain. The signature must be made with a key published under the same domain, or a subdomain. For instance, if the From is [email protected], the DKIM-Signature must use a selector like default._domainkey.shop.com, or a subdomain like mail._domainkey.shop.com.

If the signing domain is signer.example.com but the From is [email protected], DKIM alignment fails. This often happens when you use a generic signing domain across multiple clients without adjusting the selector or domain mapping.

Both SPF and DKIM alignment are enforced strictly by DMARC. Even if both records pass validation, misalignment results in a PermFail. The DMARC specification (RFC 7483) details these requirements. Many organizations see PermFail due to poor domain structuring or incorrect key publishing. Use tools that test alignment in real email delivery scenarios — like our inbox placement testing, which simulates real-world delivery behavior and flags alignment issues before you send.

What causes a permfail when SPF and DKIM are technically valid?

DMARC permfail happens when SPF and DKIM are valid but don’t align with the From domain. Even if both mechanisms pass validation, misalignment—like sending from a subdomain without SPF inclusion or using a third-party DKIM domain—triggers a permfail. This is a common reason emails end up in spam despite technically correct headers. Let’s break down why.

Domain alignment issues

  • You’re sending from a subdomain (e.g., [email protected]) but your SPF record is only set for example.com. The domain in the MAIL FROM (envelope sender) doesn’t match the From domain, causing alignment failure.
  • Your DKIM signature uses a different domain (e.g., [email protected]) while the email’s From header says example.com. Even if the DKIM signature is valid, the selector and domain don’t match the From domain—this triggers a permfail.
  • Using a third-party email service provider (ESP) like SendGrid or Amazon SES with a foreign DKIM domain (e.g., mailingdomain.com) won’t align with your From domain unless you explicitly configure domain alignment in your DMARC policy.

Why alignment matters in DMARC

DMARC evaluates both SPF and DKIM results relative to the From domain (also known as the "routed domain"). A pass at the technical level doesn’t mean alignment. The DMARC specification defines alignment as a match between the domain in the From header and the domains used in SPF's "identity" or DKIM's "d=" tag. This is why many emails pass SPF and DKIM checks but still fail DMARC.

Even if your email server correctly validates the signature, alignment issues can block deliverability. For example, using a dedicated mailing subdomain (like mail.example.com) without properly including it in SPF or aligning DKIM is enough to trigger a permfail.

Let’s say you’re sending from [email protected] and your DKIM is signed by sendgrid.net. The DKIM is cryptographically valid, and SPF is technically correct, but since both mechanisms use domains different from the From domain, DMARC sees this as a failure. This is why you need to verify not just syntax, but alignment during your email sending workflow.

Use inbox placement testing to see how your emails perform across real inboxes, including alignment behavior. The tool checks real deliverability signals, so you can detect misalignment before campaigns go live.

If you’re using a third-party ESP, make sure their DKIM domain aligns with your From domain—or set up custom DKIM using your own domain.

How to verify whether an email will pass DMARC alignment before sending?

You can verify DMARC alignment before sending by testing the email’s authentication stack in real-world conditions. Use a real-time verification tool that checks SPF, DKIM, and DMARC alignment together—not just whether signatures exist, but whether they align with the sender’s domain. MailTester’s API performs this check during live validation, flagging permfail risks even when SPF and DKIM are technically valid but misaligned. This prevents hard bounces or delivery failures caused by authentication mismatches.

Check alignment in live conditions, not in theory

SPF and DKIM can be valid but still fail DMARC if the domains don’t align. For example, a message sent from mail.example.com with a From: domain of example.com might pass SPF if the sending server is authorized, and DKIM if the signature matches, but still fail DMARC if the SPF authorizing domain doesn’t match the From domain. This is a common permfail scenario. Real-time verification tools simulate this exact behavior by examining how email providers interpret the full chain of authentication.

Test sends under real delivery environments

Even if your email passes internal checks, it may still land in spam or be rejected if the recipient’s mail server applies strict DMARC policies. A better test is to send sample messages through inbox placement tools that replicate how actual email providers—like Gmail, Yahoo, and Outlook—treat authenticated messages. These tools observe whether the message is accepted, flagged, or rejected, and report why. This gives you a direct view of whether alignment is sufficient in practice, not just in theory.

Run inbox placement tests with MailTester to see how your messages appear in real inboxes, including delivery outcome and filtering behavior. These tests reflect how providers interpret your alignment, including cases where a permfail results in a message being marked or quarantined.

What's the real-world impact of DMARC permfail on deliverability?

DMARC permfail severely impacts deliverability, even with valid SPF and DKIM alignment. Major inbox providers like Gmail and Outlook treat permfail as a red flag, often reducing inbox placement or quarantining messages—regardless of content quality or sender reputation. If your domain shows repeated permfail across high-volume sends, especially from low-traffic or weak-reputation sources, it may trigger automated blacklists or reputation filters.

Why inbox providers flag permfail

Even if a message passes DKIM and SPF checks, a permfail means one or both mechanisms failed validation, but the domain still claimed alignment. This inconsistency disrupts the authentication chain that providers use to assess sender trust. Gmail’s guidelines, for instance, emphasize that DMARC failures—especially permanent ones—trigger deeper scrutiny, especially when repeated.

Let's be clear: a permfail isn't just a technical detail. It signals a mismatch in how the message was signed versus how it was sent. Providers treat this like a potential spoofing signal. In practice, this can lead to higher bounce rates, even if your list is clean and your server is well-configured.

When permfail becomes a reputation risk

High volumes of permfail, particularly from domains with low typical send volume, can raise red flags with sender reputation systems. ISPs use patterns of authentication failures to detect abuse or misconfiguration. A sudden spike—even if technically valid—can trigger alerts or temporary blocks.

For example, a small business sending 1,000 emails a day might see no issues with a few permfail exceptions. But if 20% of those emails trigger permfail, the behavior starts looking suspicious. It’s not enough to pass individual checks—consistency matters. That’s why ongoing verification is crucial.

Use MailTester’s inbox placement analysis to simulate how your messages land across major providers. It includes DMARC signal evaluation and real-time feedback on authentication alignment. For teams managing large lists, bulk verification catches domains and addresses prone to permfail before they cause harm. Real-time API verification ensures every new address meets authentication standards at point of entry. This level of control reduces the risk of accidental permfail across campaigns.

How does MailTester detect and prevent permfail risks?

MailTester catches DMARC permfail risks by analyzing email addresses during bulk list verification, checking for alignment between SPF and DKIM—even when both technically pass. It flags domains that have previously sent with misaligned authentication, preventing your campaign from hitting inbox filters due to inconsistent policies. This proactive step reduces the chance of messages being rejected or marked as suspicious before delivery.

Post-delivery validation with real-world signals

Most tools stop at basic syntax or SMTP checks. MailTester goes further by simulating the real delivery environment, including DMARC alignment tests on domains that have been observed sending. While an address might resolve and accept mail, a history of misaligned SPF or DKIM from the same domain raises a red flag. This approach detects risk not just in the moment, but based on behavior seen across hundreds of millions of authenticated messages.

For example, if a domain has sent messages where SPF passed but the alignment didn’t match the From domain, even if the message was accepted, it was likely flagged by DMARC. MailTester picks up on these patterns using a model trained on actual email delivery outcomes. The result: you catch the risks before they affect reputation, especially in large sends where one misaligned message can trigger filtering across multiple ISPs.

Accuracy backed by real data

Our detection model achieves 98.9% accuracy, based on analysis of real-world email delivery logs and DMARC reports. This isn’t theoretical—it reflects actual patterns seen in major inbox providers’ handling of authenticated messages. You can find similar principles discussed in the DMARC.org documentation, especially around alignment requirements and how receivers evaluate the full authentication chain.

By identifying addresses linked to domains with poor alignment history, MailTester helps you avoid the “gray zone” where messages pass technical checks but still face delivery issues. This is especially important when sending to large domains like Gmail, Microsoft, or Yahoo, which enforce alignment strictly. You’re not just validating addresses—you’re validating the full delivery posture of each domain.

Can you fix a permfail after it's detected in a campaign?

You cannot fix a DMARC permfail for messages already sent. The email has already passed through the receiving system’s validation pipeline, and the outcome (permfail) is final. While you can correct the underlying SPF or DKIM misalignment, that only affects future emails, not the ones already delivered or rejected. Detection during a campaign means prevention failed — the real fix is stopping the use of problematic senders or domains going forward.

Why real-time fixes don’t work

Once an email leaves your server, you no longer control its journey. Even if you update your SPF record or re-sign messages with DKIM, the original delivery attempt has already been evaluated. The receiving server checks alignment and authentication at the moment of receipt, not after. Re-signing or reconfiguring doesn’t retroactively change that decision. It’s like patching a cracked windshield after the car has already hit a tree.

SMTP delivery is synchronous but irreversible. The bounce, failure, or rejection you see in logs reflects the final result of the delivery path. If a message fails DMARC alignment, the mail server has already decided, often within seconds. You can't "re-send" it with corrected headers because the receiving server either accepted it with a permfail or rejected it entirely — either way, the window is closed.

The only effective solution: prevention and alignment

When a domain or sender consistently triggers permfail, it’s a signal that something structural is wrong. The root cause is usually missing or incorrect alignment between SPF, DKIM, and the From domain. For example, if SPF passes but the From domain doesn’t match the sender’s domain, DMARC will fail — even if both SPF and DKIM are technically valid. This kind of misalignment is common with third-party sending platforms or internal mail relay configurations.

You can prevent these issues with verification before sending. Tools like bulk email list verification or real-time verification via API can identify invalid or high-risk domains before they enter your campaign. These tools test DNS records, check for catch-all addresses, and evaluate authentication health — including SPF and DKIM consistency — to spot alignment risks early.

DMARC reports, available through tools like DMARC Analyzer or built into most email providers, help identify which senders or domains are causing alignment failures. Reviewing them regularly is essential. If a domain consistently fails alignment, it should be removed from your sending list or redirected to a properly authenticated channel.

Common misconceptions about DMARC alignment and authentication

You might think valid SPF and DKIM automatically mean DMARC passes, but that’s not how it works. DMARC only evaluates authentication when both SPF and DKIM are aligned with the domain in the From header. A valid signature or alignment check doesn’t help if the domains don’t match. This is why even perfectly configured SPF and DKIM can fail DMARC unless alignment is correct. Let’s break down the myths so you don’t waste time chasing false positives.

Myths about authentication and DMARC outcome

  • Just because SPF and DKIM pass doesn't mean DMARC passes—alignment is non-negotiable. If the SPF mechanism uses a different domain than the From header, DMARC fails.
  • DMARC isn’t just for spoofing protection. When policies are enforced (like quarantine or reject), failing DMARC directly impacts inbox placement. Even a DMARC policy with reject can filter your messages if alignment fails.
  • Not all DMARC policies cause delivery issues. A none policy won’t block mail, but it still sends reports. Ignoring permfail results can mean missing critical feedback about email source misalignment.
  • Alignment isn’t optional. For DKIM, the From domain must match the d= tag in the signature. For SPF, the sender domain must match the h= domain in the header. One mismatch breaks the chain.

Why permfail matters even with lenient policies

Many think only strict DMARC policies cause problems. But even with a none policy, DMARC permfail results signal that your email fails alignment—possibly sending to spam folders or lower-tier servers. If you don’t act on the data, you’re losing delivery visibility.

Let’s use a real example: an email sent from [email protected] uses SPF with include:spf.example.org. If example.org doesn’t match example.com in From, SPF fails alignment. DKIM might pass, but DMARC still fails.

You can spot these issues before they hurt deliverability. Use a real-time email verification tool to test how your email appears to receivers. Test inbox placement with real inbox data across providers. This helps you validate not just syntax, but whether your email actually lands where it should.

DMARC permfail with aligned SPF and valid DKIM often means your sending domain doesn’t match the From domain, or your authentication setup is inconsistent across subdomains. To prevent this, audit your SPF and DKIM records for uniformity, ensure the From address aligns with your DKIM signing domain, and verify your sender setup with reliable tools before sending. Use MailTester’s bulk verification to catch alignment issues at scale.

  1. Audit all sending domains and subdomains for consistent SPF and DKIM configurations. Inconsistent records cause permfail even when SPF and DKIM individually pass. If your SPF includes multiple domains but doesn’t align with your From address, DMARC will reject the message. Use tools like MxToolbox or check your DNS with RFC 7073 to validate the structure. Any discrepancy across subdomains—especially those used for newsletters or transactional emails—increases failure risk.
  2. Ensure the From domain matches the DKIM signing domain (or a trusted subdomain) for all senders. DKIM signing domain must align with the From domain per RFC 7680. If you sign with example.com but send from [email protected], even with valid signatures, it triggers permfail. This is especially common with third-party platforms. If you use a subdomain for sending (e.g. mail.yourcompany.com), make sure it's explicitly included in both SPF and DKIM, and that your From address reflects that trust path.
  3. Use tools like MailTester to verify bulk lists and detect alignment issues before sending. Email-verification services help identify invalid, catch-all, or role-based addresses that increase spam risk and can skew deliverability. With MailTester’s bulk verification, you can test large lists and receive detailed feedback on alignment status, deliverability risk, and validity—before sending. This prevents campaigns from hitting DMARC enforcement due to misaligned or invalid addresses.
  4. Monitor DMARC reports (if available) for unexpected permfail patterns. If you have DMARC reporting enabled, regularly check aggregate reports at dmarcanalyzer.com or your email provider’s reporting tool. Sudden spikes in permfail, especially from trusted domains or subdomains, signal misconfiguration or spoofing attempts. Use this data to identify and fix alignment gaps before they impact inbox placement.
  5. Avoid using third-party services that sign with mismatched domains unless properly aligned. Many ESPs sign messages using their own domain (e.g., sendgrid.net) instead of your domain. If the From address doesn’t match this signing domain and alignment isn’t enforced, permfail occurs. Require third-party senders to align their DKIM signature domain with your From address, or use a subdomain that’s managed under your control, such as mail.yourcompany.com.

Why alignment matters

DMARC’s purpose is to prevent spoofing. When SPF and DKIM are valid but misaligned, it means a domain was used without proper authorization. Even with valid cryptographic signatures, alignment failure leads to rejection—even if the sender is legitimate. This is why automated verification and consistent configuration are non-negotiable.

The bottom line: alignment is the gatekeeper of deliverability

Valid SPF and DKIM are essential, but they do not guarantee inbox placement. Without proper DMARC alignment, even technically correct authentication can fail.

Why alignment matters

DMARC alignment performs the final check in the delivery chain. It validates that the sender domain in the email header matches the domains used in SPF and DKIM.

If the alignment fails—like a valid SPF with a mismatched organizational domain—receiving providers treat the message as untrusted. This leads to blocking or quarantine, even with valid signatures.

Prevention beats reputation damage

Issues like DMARC permfail with aligned SPF and valid DKIM are invisible to most senders until they see high bounce rates or poor inbox placement.

Proactive verification with tools like MailTester identifies alignment problems before sending. This prevents reputation harm and ensures only deliverable addresses move through your workflow.

Sources

Keep reading

Ready to put this into practice? MailTester verifies emails with 98.9% accuracy — start with 100 free verifications.

Frequently asked questions

What is a DMARC permfail with aligned SPF and valid DKIM?

A DMARC permfail occurs when SPF and DKIM pass validation but the domains don't align with the From header. This can still cause delivery rejection even with technically valid authentication.

Can valid DKIM and SPF cause a DMARC permfail?

Yes, if the signing domains don’t align with the From domain. Alignment is required to satisfy DMARC policy, even if authentication checks pass.

Does DMARC only reject messages with failed SPF or DKIM?

No. DMARC can reject messages where SPF and DKIM pass but fail alignment. The policy applies to the combination of all three mechanisms.

How does MailTester detect permfail risks?

It analyzes domain-level alignment during verification, flagging addresses associated with senders that have historically sent with misaligned SPF or DKIM, even when individual signatures appear valid.

Can permfail be fixed after sending?

No. The damage is done at delivery. The only fix is preventing misaligned sends in future campaigns through verification and alignment audits.

How common are DMARC permfails?

They are common in multi-tenant email setups, third-party senders, and domains with inconsistent SPF delegation. They often go unnoticed until delivery drops.

Does a DMARC none policy prevent permfail?

No. A 'none' policy means messages are not rejected, but permfail results are still logged. Permanently failing alignment can still harm reputation over time.

Should I change my DMARC policy to reject permfails?

Only if you have full control over sending sources and can ensure alignment. Most organizations start with 'none' or 'quarantine' to avoid accidental delivery failure.

Does MailTester check DKIM alignment?

Yes. It verifies DKIM signature domains against the From header domain, flagging mismatches that trigger permfail under DMARC policy.

What’s the best way to test for DMARC permfail?

Use inbox placement tools and real-time email verification with alignment detection, such as MailTester’s API, which identifies alignment issues before messages are sent.

Is DMARC alignment only relevant for large senders?

No. Even small campaigns can be blocked if sent from a misconfigured domain or third-party service with alignment issues.

Can a catch-all address cause DMARC permfail?

Yes. Catch-all domains often accept mail from misaligned sources, which can result in permfail if the From domain doesn’t align with the sender’s authenticating domains.