Fix DMARC Alignment in HTML Email

Why does your multipart/alternative email fail DMARC alignment?

You send a clean, professional email. It renders fine. All the tracking pixels load. Then, it gets rejected — silently — by Gmail or Outlook. You check the logs. The reason? DMARC alignment failure. Not because of a typo. Not because of a bad IP. Because of how your HTML email is structured.

In multipart/alternative emails, the From domain and your embedded content often don’t match. A logo from cdn.yourcompany.com, a tracking pixel from analytics.yourapp.net, or a link in the web version pointing to yourapp.com instead of yourcompany.com — small differences, but enough to break alignment.

DMARC requires both the From header and the DKIM signature to resolve to the same domain. Mismatched domains in the HTML part of a multipart message trigger rejection — even if your email looks and behaves perfectly.

Key takeaways

DMARC alignment fails when the domain in the From header doesn’t match the domain in the DKIM signature, especially in multipart/alternative emails.
Embedded assets like images, links, or tracking pixels from a different domain than the From domain break alignment and cause delivery failure.
Even minor domain mismatches in the HTML part — like mail.yourcompany.com vs yourcompany.com — can result in DMARC rejection by major providers.

What happens when DMARC alignment fails?

When DMARC alignment fails in multipart/alternative emails with embedded HTML, major email providers like Gmail, Yahoo, and Outlook often reject the message outright or flag it as spam. This happens because the sender’s domain in the From header doesn’t match the domain used in the email’s authentication headers (SPF and DKIM), breaking DMARC’s policy enforcement. Without proper alignment, your message risks being silently dropped or relegated to spam folders, undermining deliverability.

Why alignment matters in multipart/alternative messages

HTML emails using multipart/alternative content contain both plain text and HTML parts. Each part may cite different domains—like a From: address from your main domain and an embedded image from a third-party CDN. If those domains don’t align with the authenticated domain in SPF or DKIM, DMARC sees it as a mismatch. This is common when embeds or tracking pixels use subdomains like img.yourcompany.com without aligned authentication.

DMARC alignment failures don’t just trigger one bounce—they accumulate. Each failed delivery harms your sender reputation over time, especially if the same domain appears in multiple components inconsistently. According to industry data from Return Path (now Validity), domains with repeated DMARC failures see inbox placement drop below 70% for high-volume senders, even with clean content and low complaint rates.

Once reputation degrades, recovery is slow. Email providers track alignment patterns across multiple messages. A single failure might be ignored; repeated failures signal poor sender hygiene. If your email contains links, images, or tracking pixels hosted under different domains than your From address—and those domains lack proper SPF, DKIM, or DMARC policies—this compounds the risk of failure.

Let’s say your HTML email uses https://static.emailservices.com for assets. If emailservices.com doesn’t have a domain-aligned DKIM signature or SPF record, DMARC sees it as misaligned. Even if your primary domain is clean, the entire message can be blocked.

Fixing it begins with consistent domain ownership across all components. Use tools like MailTester’s email checker to spot alignment mismatches before sending. Verify that every domain used—whether for images, links, or tracking—is correctly authenticated and aligned with the From domain.

How to diagnose DMARC alignment failure in your email

Check your email headers using a tool like MxToolbox or mail-tester.com. Look for mismatches between the 'From' domain, the DKIM-Signature domain, and embedded content domains. If they don’t align, DMARC will fail. Confirm that 'Return-Path' and 'From' domains match, as divergence breaks alignment. Use these steps to root cause the issue before fixing it.

Start with full header analysis

Send a test email to yourself and download the full headers.
Use MxToolbox’s Email Header Analyzer or MailTester’s email checker to inspect them.
Look for the DKIM-Signature field — its d= value is the domain used to sign the message.
Compare that domain with the From: address. They must match for alignment.

Check embedded content and return path

Scan the email body for any embedded images, links, or tracking pixels from different domains.
If img src="https://tracking.example.com/logo.png" appears, the domain in the HTML must align with the From domain unless it’s explicitly allowed by a SPF/DKIM/DKIM policy.
Check the Return-Path header. If it differs from From, DMARC alignment fails even if DKIM passes.
Remember: DMARC checks alignment of both From and SPF (via Return-Path). A mismatch in either breaks policy.
Follow the guidelines in RFC 7052 to understand how email authentication frameworks validate sender identity in multipart/alternative messages.

Alignment isn't about whether the email works — it's about whether the receiving system trusts the sender.

Once you’ve confirmed the domain mismatch, the next step is to correct your email setup. Make sure all domains used in the message — especially in HTML, links, and tracking — match the authenticated domain in DKIM and SPF. If you’re using a third-party ESP, double-check their default settings for embedding or tracking. MailTester’s inbox placement tool can simulate real-world delivery and show how alignment affects placement in inboxes.

Step-by-step: Fixing DMARC alignment for multipart/alternative emails

DMARC alignment fails when your email’s HTML body uses domains not aligned with the 'From' address, like embedded images or tracking pixels from third parties. To fix it, ensure every external domain in your email—links, images, tracking beacons—is either owned by your organization or properly authenticated via SPF/DKIM. Reconfigure resources to use your 'From' domain, or align third-party domains with your authentication policies. Sign the entire message with the 'From' domain’s DKIM key, and use canonical HTML/text content to prevent rendering issues. Test post-send with header analyzers or deliverability tools.

Diagnose and map all domains in your email

You can’t fix what you don’t see. Open your email’s raw source and list every domain used in the HTML body: image URLs, link targets, tracking pixels, embedded stylesheets, and background images.

Let’s say your 'From' domain is company.com, but you’re loading images from cdn.othercompany.com. That’s a mismatch. This is where DMARC alignment breaks.

According to RFC 7052, DMARC validates the "From" domain through both SPF and DKIM checks. If either fails, the email may be rejected or marked as suspicious.

Identify all domains in your email body—including those in img tags, href attributes, and tracking pixel URLs. Note whether they belong to your organization. RFC 7052 details how SPF and DKIM alignment are evaluated.
Ensure every domain is owned or aligned. If not, either migrate resources (e.g., images, scripts) to your domain or configure DKIM/SPF for the third-party domain. You cannot rely on passive trust in external domains.
Re-sign only with the 'From' domain. Your DKIM signature must be created using the private key for the 'From' domain. Signing with a subdomain key (e.g., tracking.company.com) won’t align.
Use canonical content. Avoid duplicating content between text and HTML parts. Consistent versions reduce parsing issues across clients. Inconsistent rendering can lead to misinterpretation by DMARC validators.
Re-send and verify. Use a header analyzer like MxToolbox or MailTester’s inbox placement tool to check alignment post-send. Test inbox placement to confirm your fixes improved deliverability.

Keep it simple, keep it consistent

Every embedded resource is a potential alignment hole. A single unaligned image or pixel can break DMARC. Treat your email as a single authenticated object—not a collection of external links.

If you're using a marketing platform, ensure it’s not rewriting DOM elements or injecting third-party content without alignment. Review your ESP’s documentation on Content-Type: multipart/alternative handling.

DMARC alignment isn't optional—especially for transactional or high-value email. Failures lead to higher bounce rates, blocked messages, and degraded sender reputation.

Best practices for maintaining DMARC alignment in rich HTML emails

You fix DMARC alignment failures in multipart/alternative emails by ensuring all elements—From domain, DKIM signature, and embedded assets like images and tracking links—use the same domain. If any part references an external domain, DMARC checks fail unless that domain is explicitly authorized. Use consistent, verified domains across all layers, and validate your setup with inbox placement testing before sending to large lists.

Domain consistency is non-negotiable

Always use the same domain for the From header, DKIM signature, and all embedded assets like images, CSS, or tracking pixels.
Never let a tracking script or image load from a third-party domain unless that domain is listed in your SPF and DKIM records.
Use relative URLs (e.g., /track/123 instead of https://tracking.example.com/track/123) when possible—this reduces dependency on external domains.

Testing and rendering prevent misalignment

Test every email template in real inboxes using an inbox placement tool before sending bulk campaigns. This catches alignment issues and spam filter reactions early.
Render dynamic content on the server side. Client-side scripts or templating engines that inject domains during delivery can break alignment if not controlled.
Verify embedded links and domains using a real-time email checker before sending—tools like MailTester’s email checker expose invalid or misaligned addresses before they hit the inbox.
Use only authenticated, whitelisted CDNs. If you must use an external CDN, ensure it’s covered by your SPF and DKIM policies, and monitor domain reputation via services like Spamhaus.

DMARC alignment is not optional—it’s the foundation of sender reputation. Even one embedded asset from an unaligned domain can cause a legitimate email to be rejected.

Even small misalignments—like a tracking pixel from a different domain—break DMARC. The standard says alignment must match between From and both SPF and DKIM results. Use tools like MailTester’s inbox placement tester to simulate how your email performs across major providers before deployment. Consistency, control, and verification are the only reliable path forward.

How to test if your fix worked

After adjusting your email headers or DKIM configuration, send a real message from your production system to an inbox you control. Download the full message headers and inspect them using a tool like MailTester or MxToolbox. Confirm the From domain matches the DKIM-Signature's domain, and check that DMARC reports show alignment status as 'pass' for both SPF and DKIM. Test across multiple providers—Gmail, Outlook, Apple Mail—to ensure consistent results.

Step-by-step verification process

Send a test email from your production environment to an email address you manage. Use the same configuration and sending path you use for live campaigns. This ensures the test reflects real-world behavior and isn't affected by staging or development quirks.
Retrieve the full email headers from your inbox client. In Gmail, click the three dots > "Show original"; in Outlook, use "View Source" from the message menu. Save the full header content for analysis.
Validate DKIM alignment by finding the DKIM-Signature header. The d= value must match the domain in the From: header. If not, your DKIM is misaligned regardless of signature validity.
Confirm SPF alignment by locating the Authentication-Results header. Look for spf=pass and verify it applies to the same domain used in the From: field. If spf=pass but the domain differs, alignment fails.
Check DMARC alignment status in the Authentication-Results or DMARC aggregate report (if you receive one). Both SPF and DKIM must show alignment status of pass. A failure here means the email may be marked as suspicious or rejected, even with valid signatures.
Repeat across inbox providers. Use different accounts (e.g., Gmail, Outlook.com, iCloud) to test whether the alignment pass is consistent. Some providers enforce stricter checks than others.

Why consistency across providers matters

Not all email providers treat alignment identically. Gmail may allow minor inconsistencies, while Microsoft and Apple often reject messages with any alignment failure. Testing across multiple inboxes ensures your setup works reliably for the broadest audience. According to RFC 7052, alignment is a core part of SPF and DKIM’s role in protecting senders, so consistent alignment is not optional.

The 6 steps described in “Step-by-step verification process”, in order.

If any step fails, revisit your DKIM signing configuration or SPF setup. Use MailTester’s inbox placement tester to simulate how your email lands in real inboxes, including DMARC checks, before sending to your list.

Common pitfalls that re-introduce alignment issues

DMARC alignment fails when your email’s From domain doesn’t match the domains used in the message’s header fields or embedded content—especially in multipart/alternative emails with HTML. Even tiny mismatches, like a test URL or a third-party asset from a different domain, can break alignment. Let’s walk through real-world missteps that sabotage your DMARC results, even after initial fixes.

Templates with placeholder domains

Using http://example.com/image.jpg or similar in your HTML templates before deploying to production breaks alignment, even if the final image is hosted on your domain.
Any placeholder domain—test.com, localhost, or dev.example.com—that remains after deployment violates DMARC if it appears in an img tag, background style, or href.
Use relative paths or template variables so your build process replaces these with real domain URLs before sending.

Third-party content and hidden mismatches

Content from landing pages, embedded forms, or marketing automation tools (like HubSpot, Mailchimp, or Klaviyo) often pulls assets using their own domains. These bypass your control and break alignment.
Even subtle elements like SVG-based buttons or external stylesheet links (https://cdn.somelibrary.com/style.css) can trigger failures if they reference a non-aligned domain.
Always audit every embedded resource—image URLs, CSS files, scripts, and background-image declarations—to ensure they resolve to your domain or a partner with aligned DNS.

Confusing domain equivalence with DNS alignment

Just because a domain uses HTTPS or shares a subdomain (like mail.yourcompany.com) doesn’t mean it aligns with your From domain. DMARC checks the actual domain, not the protocol or subdomain hierarchy.
For example, mail.yourcompany.com in your headers doesn’t align with yourcompany.com unless you’ve specifically set up DMARC policy for both.
See RFC 7001 for the formal definition of alignment—it's not based on trust or visibility, but on exact domain matching in headers and content.

DMARC alignment is not about security hygiene. It’s about strict domain matching in both the message envelope and the content.

Once you’ve fixed initial alignment issues, re-checking your entire content stack is critical. A single unresolved link can undo months of domain compliance work. Use tools like Spamhaus ZEN or MXToolbox to validate your DNS records and content sourcing.

Prevent recurrence by validating every template and external asset before sending. Run inbox placement tests with tools like MailTester's Inbox Placement to catch failures early and test how your email renders in real mail clients.

Why DMARC fails even when SPF and DKIM are correct

DMARC alignment failure happens when SPF or DKIM pass individually, but the domains they authenticate don’t align with the From domain in your email. DMARC requires both authentication and alignment — one without the other isn’t enough. Even if DKIM’s signature validates, it only counts if the d= domain in the signature matches the From domain or the Return-Path domain. This mismatch is a common reason your emails are still rejected, even with correct SPF and DKIM setups.

SPF and DKIM are not enough on their own

When you check SPF and DKIM results, they might both return as "pass," but that doesn’t guarantee DMARC success. DMARC evaluates alignment between the authenticated domains and the visible From address. If they don’t match, the email fails DMARC, regardless of how well SPF and DKIM are configured.

Let’s say your email uses spf=pass from send.mycompany.com, and DKIM signs with d=mailingprovider.com, but the From field says [email protected]. SPF passes because the sending domain is trusted. DKIM passes because the signature is valid. But neither matches the From domain, so alignment fails and DMARC rejects the message.

Why DKIM alignment is misunderstood

Many senders assume that because DKIM passes, it’s automatically aligned. That’s incorrect. DKIM alignment depends on the d= tag in the signature matching the From domain or the Return-Path domain. If it doesn’t, even a valid signature won’t satisfy DMARC.

For example, if your DKIM signature uses d=external-sender.com but the From header says [email protected], there’s no alignment — and DMARC will fail. This is a common issue when using third-party email services, especially if domains in the signature aren’t updated to match the sender’s visible domain.

Proper alignment is defined in RFC 7052, which specifies that DMARC alignment requires both SPF and DKIM to be aligned with the From domain. It’s not optional — it’s the rule. Misaligned DKIM is as harmful as a failed SPF.

Use MailTester’s inbox placement tester to simulate how your emails perform across real inboxes, including detecting DMARC failures before they affect deliverability.

How MailTester helps avoid DMARC issues before they cause bounces

You can catch DMARC alignment failures early by validating email addresses and domains in real time, testing your email templates in simulated inboxes, and using automated checks for common HTML misconfigurations. This stops bounces and inbox placement issues before they happen. Let's walk through how.

Pre-send checks that prevent alignment failures

Use the real-time verification API to validate individual addresses and their domains — it checks DNS records, catch-all status, and domain reputation, catching issues before they trigger DMARC rejection.
Run inbox-placement tests on your email templates via the inbox tester to see how your HTML and embedded content appear in real inboxes. This reveals alignment mismatches between the From domain and content domains.
Check embedded HTML for broken link structures or mismatched domains. The in-app AI assistant scans for common alignment misconfigurations, like img or link tags pointing to a different domain than the one in the From: header.
Integrate MailTester with your email service — SendGrid, HubSpot, Klaviyo — to automatically flag risky addresses and alignment issues during sending workflows. It stops problematic sends before they reach the inbox.

Catch scale problems before they hurt deliverability

Test high-volume lists with bulk verification. It identifies invalid addresses, disposable domains, or poorly aligned domains across thousands of records — reducing the risk of bulk delivery penalties.
Verify the domain authority of each recipient’s domain. Some domains fail DMARC because their SPF or DKIM policies are missing or misconfigured — MailTester surfaces this during real-time checks.
Use the tool to detect common pitfalls in multipart/alternative emails: when the HTML part uses a different domain than the plain text part, alignment fails. The system flags this inconsistency early.
For context, DMARC requires alignment between the From: header and the domain used in SPF and DKIM authentication. Misalignment — even if only in embedded resources — is a common reason for rejection. The DMARC specification (RFC 7052) outlines this clearly.

These checks aren’t optional. They’re how you keep your send rate high and your reputation clean. Let MailTester catch the errors your inbox doesn’t. You’ll send fewer bounces, fewer complaints, and higher inbox placement. That’s real deliverability.

DMARC alignment is not optional — it’s required for inbox delivery

You must fix DMARC alignment in multipart/alternative emails with embedded HTML because even if your message reaches the inbox, a misalignment can trigger long-term suppression by ISPs, break sender reputation, and increase chances of being flagged as phishing. Modern gateways like Amazon SES, SendGrid, and Mailgun now reject or quarantine emails with failed DMARC alignment, regardless of SPF or DKIM validity. Addressing alignment issues early prevents future delivery failures and ensures reliable inbox placement.

DMARC alignment failure harms delivery—no matter what

Even if your email lands in the inbox today, a DMARC alignment failure can quietly damage your sender reputation over time. Reputable email gateways now validate alignment as part of their filtering logic. If the From domain doesn't align with either the SPF or DKIM validating domain (especially in multipart/alternative messages), the message may be suppressed in future sends. This happens even when the technical authentication passes elsewhere.

Let’s be clear: misaligned emails are more likely to be flagged during automated phishing detection. The email’s structure—with HTML and plain text parts—makes it harder for some systems to verify legitimacy, and without domain alignment, the signal weakens. The result? Increased risk of filtering or outright blocking, especially for bulk senders.

How to correct alignment in multipart/alternative emails

For emails with both plain text and HTML, ensure that both parts use the same From domain and that the DKIM signature aligns with it. If you’re using a sending service or ESP, verify that the From domain in the message header matches the domain used in SPF and DKIM records. Any third-party email tools or template systems should preserve this consistency across all parts.

Test your deliverability with tools that simulate real inbox conditions. MailTester’s inbox placement tests can identify alignment issues before your campaign goes live. You can also use real-time verification to catch invalid or misaligned addresses in your list before sending.

Alignment isn't a one-time fix. Regular testing with tools like MailTester’s bulk verification helps you detect problems in your list and maintain high deliverability. RFC 7052 and reports from industry groups like the Messaging, Malware, and Mobile Anti-Abuse Working Group (M3AAWG) emphasize alignment as a baseline requirement for trusted email. It’s not just a technical detail—it’s a delivery necessity.

Final takeaway: Align domains, not just protocols

SPF, DKIM, and DMARC are not standalone checks. They only work when domains align across the entire email flow — from the sender address to the embedded content.

Even perfectly signed messages fail DMARC if the From domain doesn’t match the headers or the embedded content’s base domain. This is alignment, not just syntax — it’s the final gatekeeper for inbox placement.

What to do next

Use the same domain for your sender address, DKIM signature, and all embedded content (images, links, buttons).
Validate every email template in a real-world environment — not just in testing tools.
Check DMARC reports regularly. Misalignment often shows up as failed policy evaluations, not immediate bounces.

Sources

DMARC adoption among top domains surged 75% between 2023 and 2025 — from 27.2% to 47.7% — in the wake of Google and Yahoo's bulk-sender authentication requirements. — EasyDMARC 2025 DMARC Adoption Report (2025)
Since May 5, 2025, Microsoft Outlook requires SPF, DKIM, and DMARC from domains sending 5,000+ emails per day, rejecting non-compliant mail outright at the SMTP level with error 550 5.7.515. — Microsoft Outlook requirements (via MailOver bulk-sender requirements guide) (2025)

Keep reading

Ready to put this into practice? MailTester verifies emails with 98.9% accuracy — start with 100 free verifications.

Frequently asked questions

What is DMARC alignment in multipart/alternative emails?

DMARC alignment requires that the 'From' domain matches the domain used in the DKIM signature and the 'Return-Path' address. In multipart/alternative emails, this applies across all parts, including embedded content.

Can I use a different domain for images in HTML emails?

Only if that domain is properly authenticated and aligned with the 'From' domain. Otherwise, it breaks DMARC.

Why does my DKIM pass but DMARC still fail?

DKIM can validate signatures, but alignment fails if the 'd=' domain in the DKIM header doesn’t match the 'From' domain.

Do I need to align every embedded link in my email?

Yes — any external domain used in the body, such as in images, links, or tracking scripts, must align with the 'From' domain to pass DMARC.

How often should I test for DMARC alignment?

Test every new template and after any change to domain usage. Run periodic full inbox tests on your high-volume campaigns.

Can MailTester detect DMARC alignment issues?

Yes — through inbox-placement testing and header analysis, it identifies alignment failures before they impact deliverability.

Is DMARC alignment required for all email senders?

It's required for bulk senders. Even individual emailers may face delivery issues if alignment fails.

Can I fix DMARC alignment without changing my email content?

Only if the domains used are already aligned. Otherwise, restructuring embedded content or domains is necessary.

What’s the impact of ignoring DMARC alignment?

Emails may be blocked or marked as spam. Reputational damage occurs over time, reducing inbox placement and increasing bounce rates.

Does using a CDN break DMARC alignment?

Yes — if the CDN uses a different domain than the 'From' address, it breaks alignment unless properly authenticated and aligned.