DNS DKIM Record Checker: Spot d= vs i= Misalignment in 2026

Why is d= domain vs i= identity alignment critical for email deliverability?

You send a perfectly formatted email. SPF passes. DMARC passes. DKIM signature is valid. Yet it lands in spam — or worse, gets silently rejected. Why?

The answer often lies in a subtle but deadly misalignment: the d= domain in your DKIM signature doesn’t match the i= identity the recipient sees. This mismatch breaks trust, even when all technical checks pass. It’s like showing a driver's license with the wrong name — the ID is real, but it doesn’t prove who you claim to be.

This article explains how a DNS DKIM record checker can detect d= domain vs i= identity misalignment — a common blind spot in email authentication. You’ll learn how this misalignment impacts deliverability, damages sender reputation, and leads to inbox placement drops, even with technically correct headers. We’ll show you how to spot and fix it before your next campaign.

Key takeaways

• DKIM alignment failure — even with valid DKIM signatures — can trigger email rejection by receivers.
• The d= domain in the DKIM signature must match the i= identity (typically the From domain) to maintain authentication trust.
• Using a DNS DKIM record checker helps detect misalignment before sending, avoiding deliverability issues caused by hidden authentication flaws.

What exactly is d= domain vs i= identity misalignment?

DKIM alignment fails when the domain signing the email (d=) doesn't match the sender’s domain (i=) or a subdomain of it. If your From address is [email protected], the DKIM signature must use acme.com or a subdomain like mail.acme.com. Using a different domain like vendor.com — even if properly signed — breaks alignment and can trigger spam filters. This is a key reason emails fail DMARC checks and land in junk folders.

Understanding d= and i= in DKIM

When an email is signed with DKIM, two key tags matter: d= and i=. The d= tag identifies the domain that authorized the signature — the domain you own and published the DKIM key for. The i= tag shows the actual sender’s identity, typically from the From header.

Think of it like a notarized letter: d= is the organization that issued the official seal, while i= is the specific person whose name appears on the document. For the verification to hold, the issuing organization (d=) must match or be a subdomain of the sender's domain (i=).

Why alignment matters for deliverability

Even if your DKIM signature is valid, misalignment between d= and i= breaks DMARC policies. Many mailbox providers, including Gmail and Outlook, require both SPF and DKIM to align with the From domain. A mismatch here can cause messages to be flagged or rejected without warning.

For example, if a message from [email protected] has a d=vendor.com signature, it fails alignment — even if vendor.com's DKIM key is valid. This breaks trust and harms sender reputation over time.

To catch this before sending, use a real-time email checker that validates the full DKIM chain. MailTester’s service verifies alignment by inspecting both the signing domain and the identity domain, helping to prevent misconfigurations that sabotage deliverability.

The core fix is simple: ensure your DKIM d= tag points to a domain that aligns with the i= value — either the same domain or a subdomain. This is a standard, documented practice defined in RFC 6376, which outlines how DKIM works across mail systems. For deeper setup guidance, refer to the official DKIM specification.

How does DKIM misalignment affect real-world deliverability?

Even if your email passes SPF and has a valid DKIM signature, misalignment between the d= domain in the DKIM signature and the i= identity (usually the From address) can still trigger spam filters in Gmail, Outlook, and other major inboxes. Receivers treat this mismatch as a red flag — it’s a sign that the sender might not be who they claim to be, even if technical checks pass. This often results in lower inbox placement, higher bounce rates, or messages being marked as suspicious.

Why alignment matters to receivers

Let’s be clear: DKIM alone doesn’t guarantee deliverability. What matters is the alignment between the domain in the DKIM signature (d=) and the From domain (often from the i= header). If those don’t match, the authentication check fails from the receiver’s perspective — even if the signature is technically valid. Gmail and Microsoft’s systems have long used this alignment as a strong indicator in their spam scoring models. A misaligned DKIM signature can mean the difference between a message landing in the inbox or getting buried in spam.

Studies from industry sources like dmarc.org and email security reports show that senders with consistent alignment across SPF, DKIM, and DMARC report better sender reputation and more predictable inbox placement. Misalignment disrupts this consistency, and receivers treat it as a potential sign of spoofing or misconfigured systems — especially if it happens at scale across your mailing list.

For example, if you send marketing emails from [email protected] but the DKIM signature uses d=mailing.yourcompany.com, and that domain isn’t properly aligned with the From header, even a flawless SPF and DKIM can’t prevent filters from treating the message as untrusted. This is especially common when third-party email platforms are used for sending but their default signing domains don’t match the From domain.

What happens in practice

High rates of DKIM misalignment correlate directly with lower inbox placement. If your list contains a significant number of mismatched signatures, receivers may treat your brand as inconsistent or untrustworthy — even if you're not sending spam. This leads to higher bounce rates, more feedback loops being triggered, and a faster decline in sender reputation over time.

Let’s say you’re running a campaign and 15% of your DKIM signatures are misaligned — that’s not just a technical detail. It signals a systemic issue that receivers take seriously. Over time, this can degrade your domain reputation and lead to throttling or blocklisting, particularly if other signals (like engagement or complaints) are already weak.

You can catch these issues early by using a real-time email checker or inbox placement tester before sending. These tools validate not just syntax but real-world receiver behavior, including alignment checks, so you’re not shipping emails that fail even mild scrutiny. For larger lists, bulk verification with full DKIM/SPF alignment reporting gives you precise control over what gets sent.

Step-by-step: How to verify DKIM alignment with a DNS DKIM record checker

You can verify DKIM alignment by checking the d= domain in the signature against the i= identity’s domain using a DNS DKIM record checker. If they don’t match — even if the signature is valid — alignment fails, and your email may be marked as suspicious. This check ensures the email sender genuinely controls the domain used in the signature.

Retrieve and decode the DKIM signature

1. Open the raw email headers from your inbox or email tool. Look for the line starting with DKIM-Signature: — this contains the full cryptographic signature and key information.
2. Copy the entire DKIM-Signature: line. It will include fields like d= (domain) and i= (identity). For example: d=example.com; [email protected].
3. Extract the d= value — this is the domain that published the public key in DNS. The i= value shows the sender’s full email address, from which you’ll pull the identity domain (the part after @).

Validate DNS alignment with a DKIM record checker

4. Paste the d= domain (e.g., example.com) into a DNS DKIM record checker — we recommend RFC 6376 as the foundational standard or use MailTester’s email checker to test individual addresses and review alignment in real time.
5. Check whether a valid DKIM TXT record exists for that domain. The record must be published under selector._domainkey.example.com and contain a public key used to verify the signature.
6. Now confirm the identity domain (from i=) matches the signing domain (d=) or is a subdomain of it. For instance, if d=example.com and [email protected], alignment passes. If [email protected], it fails — even if the cryptographic signature checks out.

Alignment fails when the sending domain (d=) and identity domain (i=) don’t share a root — a mismatch that spammers exploit to spoof trusted domains.

If the domains don’t align, the email may be rejected by receivers that enforce strict DMARC policies. Most email gateways now enforce alignment as part of standard filtering. Use MailTester’s inbox placement tester to simulate delivery and check real-world alignment performance across providers.

How to detect d= vs i= misalignment using MailTester’s real-time API

You can detect d= vs i= DKIM misalignment by sending a raw email message to MailTester’s real-time API with the domain context. The API parses the DKIM signature, checks DNS records for the signing domain, extracts d= and i= values, and verifies if they align. It returns a clear pass or fail verdict, including the exact mismatch — such as “d=example.com does not match [email protected]” — and flags cases where the signing domain isn’t published in DNS or the identity domain isn’t authorized.

Step-by-step verification process

1. Send a raw message to the API with full headers and content. You can use tools like RFC 5322 as a reference for proper message formatting, ensuring all headers are included, especially DKIM-Signature.
2. MailTester parses the DKIM signature and isolates the d= (domain) and i= (identity) values. These are critical for alignment checks under DMARC policies.
3. It verifies DNS publication of the signing domain’s public key via the selector._domainkey.d= TXT record. If the record is missing or malformed, the check fails.
4. It compares d= and i= domains. If they don’t match at the subdomain level (e.g., d=parent.com vs i=app.parent.com), it’s a misalignment, even if they share a common base.
5. It returns a structured verdict: "DKIM alignment pass", "DKIM alignment fail", or "DKIM signature invalid". The output specifies the exact issue—such as "i=domain not authorized" or "d= domain not found in DNS".
   1. Check for authorized identity domains. If the i= domain isn’t listed in the d= domain’s SPF or DKIM policies, it’s flagged as unauthorized.
   2. Use results to fix configurations. Common fixes include updating DKIM selectors, aligning identity domains with authorized senders, or adjusting SPF records.
6. DMARC requires either SPF or DKIM alignment, but many email systems still reject messages when d= and i= don’t match. Misalignment is a leading cause of delivery failure — even valid emails get blocked if alignment fails. Using MailTester’s API lets you catch these issues before sending, avoiding reputation damage and inbox placement drops.
7. It supports integration with your sending workflow. You can plug the real-time API into your transactional or marketing system to validate alignment on every send.
8. You're seeing d= domain vs i= identity misalignment when your email’s DKIM signature uses a different domain than the one in the From field. This happens most often when third-party senders sign with their own domain (like mailer.com) while claiming to send as your domain (e.g. [email protected]). Misaligned signatures trigger spam filters and hurt deliverability. Let’s break down the top causes and what you can do about them.
   • You’re using a transactional or marketing platform (like SendGrid, Mailchimp, or Klaviyo) that signs emails with its own domain (e.g. mailer.vendornext.com) while your From address shows your company domain (e.g. [email protected]). The d= in DKIM points to the signing domain, while the i= points to the From domain. When they don’t match, misalignment occurs.
   • The fix: ensure your email provider supports proper DMARC alignment or use a dedicated, verified sender domain that matches your From address. Check your email service’s documentation — some allow you to configure signing domains to match your identity domain.
   • When you configure DKIM for a subdomain (e.g. marketing.yourcompany.com) but send from the parent domain (yourcompany.com), the d= and i= will differ unless the subdomain is properly aligned in DNS and your SPF/DKIM records support the parent domain.
   • Some vendors or internal mailing systems default to signing with a subdomain that doesn’t align with a parent or brand domain. This is common with bulk senders or legacy systems that weren’t updated for modern email standards.
   • When a sender uses a catch-all address (like [email protected]) for bulk emails but the DKIM signature is tied to a vendor’s domain (e.g. vendornext.com), you’ll have a mismatch between d= and i=. This often happens when list providers or marketing tools don’t validate sender identities properly.
   • Even if the address is valid, this misalignment can trigger spam filters. You can use a DNS DKIM record checker to detect these issues before sending — and avoid high bounce rates or inbox placement problems.
9. Let’s be clear: DKIM alignment is not optional. Misalignment is a key factor in email blocks and low inbox placement. The DKIM specification and DMARC guidelines both emphasize proper alignment between d= and i=. The good news? Tools like MailTester help you spot these issues early. You can test individual addresses with our email checker or verify entire lists with our bulk verification tool to catch alignment problems at scale.
10. You get clear, actionable feedback on DKIM alignment — whether the d= domain in the signature matches the i= identity, and whether the signature validates. MailTester’s API returns one of four definitive verdicts: Valid, DKIM alignment fail, Missing DKIM, or Invalid DKIM — each rooted in real DNS checks and cryptographic validation, not guesswork. This lets you catch misaligned domains before they hurt deliverability.
11. Here’s what each verdict means and how it affects your sender reputation:
12. Alignment matters because DMARC requires both SPF and DKIM to pass and for d= and i= to match. If they don’t, even a valid signature can get rejected.
13. Use the MailTester API to validate your email infrastructure at scale. It checks DNS records in real time, ensuring your DKIM configuration is both present and correctly aligned. You can integrate it directly into your send workflow — no manual DNS lookup needed.
14. The DKIM spec (RFC 6376) defines alignment; it’s an industry-standard requirement for authentication to be trusted. Misalignment isn’t a minor glitch — it’s a red flag for spammers and a signal to receivers to distrust your domain.
15. You can detect d= domain vs i= identity misalignment in your DMARC reports, but only MailTester’s inbox placement testing shows how those mismatches directly impact delivery. It sends real test emails from your domain, tracks whether they land in primary inboxes across Gmail, Outlook, and Apple Mail, and logs whether DKIM signature alignment failures correlate with delivery drops — helping you spot risks before sending to your full list.
16. While tools like MxToolbox or Spamhaus check DNS records, they don’t show what actually happens when your email hits a real inbox. MailTester goes further: it sends test messages from your domain to a controlled set of high-volume mailboxes, simulating actual send volume, and tracks inbox placement in real time. This reveals whether misaligned DKIM — where the d= domain doesn’t match the i= identity — results in filtering, even if your authentication (SPF, DKIM, DMARC) technically passes.
17. For example, a common setup where the d= domain is your sending domain but the i= identity is set to a marketing or transactional alias (like [email protected] with d=sendgrid.net) can trigger suspicion. Our testing shows that when alignment fails, placement drops—even when SPF and DMARC are configured correctly. This happens because recipient systems prioritize identity trust over technical checks.
18. Historical data from high-volume campaigns indicates alignment failure alone can reduce inbox placement by up to 20% in competitive or high-sensitivity industries. This is especially true in sectors like finance, e-commerce, and SaaS, where inboxes are tuned to detect inconsistencies in identity. The misalignment may not trigger an error, but it lowers your sender reputation signal.
19. Before sending to a large list, run an inbox placement test using MailTester’s inbox test tool. It checks not just technical headers, but whether the full delivery path — including DKIM alignment — leads to a primary inbox. You’ll see clear reports on placement rates, with root-cause analysis tied to specific headers like Authentication-Results and DKIM-Signature.
20. For real-time validation, use the MailTester API to verify addresses and validate header alignment during build. Or, check individual addresses first with our email checker. If you're running large campaigns, use the bulk verification tool to catch alignment issues across your full list before sending. This proactive approach reduces bounces and keeps your sender reputation intact.
21. For more on how authentication and identity alignment affect long-term deliverability, see the DKIM specification (RFC 6376), which defines the expected structure for both d= and i= domains. Proper alignment isn’t optional — it’s central to trust in email.
22. You fix DKIM alignment by ensuring the d= domain in the DKIM signature matches the From address domain. Mismatches break authentication and hurt deliverability. Use MailTester’s bulk verification to find and fix alignment issues before sending. Let’s walk through the steps.
    • Inspect every outgoing email: does the From address domain (e.g., [email protected]) match the d= domain in the DKIM signature?
    • Use a tool like MXToolbox’s DKIM Checker to inspect raw headers and verify d= and i= domains.
    • If the d= domain is different—say, mail.acme.com—but your From is [email protected], you have misalignment.
    • If you use a third-party sender (e.g., Mailchimp, HubSpot, Klaviyo), confirm they sign with a d= domain that aligns with your From domain.
    • Some vendors use a generic signing domain like campaigns.service.com. If your From is [email protected], this will fail alignment unless you’ve set up proper DMARC policies and authorized the service.
    • Ask your vendor for their signing domain and check it against the From address using a DKIM specification.
    • For subdomain sends (e.g., newsletter.acme.com), generate unique DKIM keys for each subdomain. Don’t reuse keys across domains.
    • Set up separate DNS records for each subdomain (e.g., default._domainkey.newsletter.acme.com) with the correct public key.
    • Use MailTester’s bulk verification to pre-check your list and flag any addresses tied to mismatched or risky sending domains.
    • Avoid catch-all domains entirely for bulk sends. They trigger spam traps and increase alignment risk when the actual recipient domain doesn’t match the DKIM d= domain.
    • Run a pre-send audit: verify that every email’s From domain maps to a matching, correctly signed d= domain in DNS.
23. Fixing alignment upfront saves time, reduces hard bounces, and improves sender reputation. Tools like MailTester help catch these issues before they impact deliverability.
24. You can’t afford to skip DKIM alignment checks if you send at scale. Even one misaligned message—where the d= domain in the DKIM signature doesn’t match the i= identity—can trigger warnings from inbox providers, lead to rate limiting, or harm your sender reputation. High-volume senders are under constant scrutiny, and misalignment is a red flag that’s easy to miss without real-time verification.
25. Inbox providers like Gmail and Outlook treat bulk senders differently than individual users. They apply stricter checks for authenticity, especially when volume spikes or patterns suggest spam. A single misaligned DKIM signature may not cause an immediate bounce, but it adds to the risk profile that could result in throttling or long-term reputational damage.
26. Even a small percentage of misaligned emails—say, 1% across a million-message campaign—can raise alarms. Providers use signals like alignment inconsistencies to detect anomalies. If your sender identity doesn’t match your signing domain consistently, it looks like an attempt to spoof or impersonate a brand, even if unintentional.
27. Waiting for bounces or delivery warnings to surface issues is far too late. Misalignment often goes undetected in traditional validation tools because they focus on syntax or address format, not the actual cryptographic and domain alignment between d= and i=. That’s why you need a tool that checks the full DKIM chain in real time, including DNS record alignment.
28. Tools like MailTester provide a live view of DKIM and alignment status across large lists. You verify domains, test for correct alignment, and catch problems before they impact deliverability. This isn’t just about accuracy—it’s about proactive risk control. For senders with volume, it’s the difference between consistent inbox placement and being throttled.
29. Use a real-time, scalable solution to validate alignment at scale—before your campaign launches. You don’t want to learn the hard way that your DKIM signature isn’t aligned with your sending identity. With MailTester, you can check individual addresses, verify bulk lists, or test deliverability with inbox placement tools. This kind of clarity keeps you on the right side of provider policies.
30. Run a bulk list verification to identify misaligned DKIM signatures in your database. Or, integrate the API into your workflow to check alignment automatically. The same checks that protect large-scale senders are available at any volume—no excuses, no delays.
31. For a deeper look at how DKIM works, see the official specification in RFC 6376. It defines the alignment rules that matter for inbox providers.
32. DKIM alignment between the d= domain and i= identity is not a checkbox—it’s a foundational trust signal for email providers. Even with a valid signature, misalignment breaks authentication and can result in inbox rejection, despite technically correct setup.
33. Verification must happen before sending, not after. A DNS DKIM record checker identifies d= vs i= mismatches early, preventing deliverability issues and protecting sender reputation.
34. MailTester’s 98.9% accuracy helps detect alignment problems before they impact your inbox placement. Use it to verify your setup and maintain trust with receiving systems.
    • 52.1% of the world's top 1.8 million domains (937,931 domains) now publish a valid DMARC record, up from 29.1% in 2023. — EasyDMARC 2026 DMARC Adoption & Enforcement Report (2026)
    • Google reported 265 billion fewer unauthenticated messages sent to Gmail users in 2024 — a 65% reduction — after its bulk-sender rules took effect, with 500,000+ top domains publishing DMARC records in response. — Google (via MailOver bulk-sender requirements guide) (2024)
35. Ready to put this into practice? MailTester verifies emails with 98.9% accuracy — start with 100 free verifications.
36. d= specifies the domain that signed the email. It is used to look up the public key in DNS for signature validation.
37. i= indicates the identity of the sender, typically the From address. It defines the domain used for identity alignment.
38. Yes. DNS validation can succeed (signature is valid), but misalignment occurs if d= and i= domains don’t match or aren’t a subdomain.
39. Misaligned DKIM signals inconsistency or lack of trust. Inbox providers use it as a risk factor, increasing the chance of filtering.
40. Yes. MailTester’s bulk list verification includes DKIM alignment checks as part of its assessment engine.
41. Not for every single message if you control the sending setup. But verify alignment for all new domains, third-party tools, or high-volume campaigns.
42. Your emails may be marked as suspicious, delivered to spam folders, or blocked entirely, especially with major inbox providers.
43. Yes. MailTester offers 100 free verifications to start, including alignment checks via its real-time API and inbox placement tests.
44. SPF alignment is based on the Return-Path domain and the From domain. DKIM alignment is based on d= and i= — they are independent but both affect deliverability.
45. At least monthly for high-volume senders, and before launching new campaigns or onboarding third-party tools.
46. Yes — for example, if i= [email protected] and d= mail.acme.com, alignment passes because mail.acme.com is a subdomain of acme.com.
47. Yes — DMARC requires either SPF or DKIM alignment to pass. Misalignment causes DMARC failure even with valid signatures.

Does DMARC require DKIM alignment?

Can a subdomain signing domain be aligned with a parent domain?

How often should I audit my DKIM records?

What’s the difference between SPF and DKIM alignment?

Is there a free way to test DKIM alignment?

What happens if I ignore DKIM alignment issues?

Do I need to check DKIM alignment for every email?

Can MailTester check DKIM alignment in bulk?

How does misalignment hurt deliverability?

Can DKIM pass but still have alignment fail?

What does i= mean in a DKIM signature?

What does d= mean in a DKIM signature?

Frequently asked questions

Sources

Conclusion: DKIM alignment isn't just technical — it's a trust signal

Check alignment before you send, not after

High-volume senders face stricter inbox provider rules

Why DNS DKIM record checking is not optional for senders with high volume

DKIM alignment is a core requirement for inbox placement. An authenticated email with misaligned domains may be blocked or sent to spam, even if SPF and DKIM are technically correct.

Verify third-party sender configurations

Check your From domain alignment

How to fix DKIM alignment: A checklist for senders and marketers

Fix alignment before you send

Real-world testing, not just diagnostics

How MailTester’s inbox placement testing reveals alignment-related delivery risks

DNS-based DKIM verdicts explained

Verdicts and alignment: What MailTester’s API returns for DKIM issues

Using catch-all or generic addresses for bulk sends

Subdomain and domain configuration issues

Third-party senders signing with their own domain

Common reasons for d= domain vs i= identity misalignment

Why this matters in real-world deliverability