SPF and DKIM Alignment Check

Why Does DMARC Alignment Fail When Domains Differ and adkim=r?

You sent a clean, well-formatted email. SPF and DKIM both passed. Yet DMARC failed — and the report says "alignment failed." You’re not alone. This happens when your SPF domain doesn’t match your DKIM domain, and you’ve set adkim=r. It’s not a misconfiguration. It’s alignment.

DMARC doesn’t care if individual checks pass. It cares whether the domains used in SPF and DKIM align with the From address. When adkim=r, the alignment check is stricter: the DKIM signature domain must match the From domain exactly, including subdomains. If it doesn’t, DMARC fails — no matter how clean your setup is.

Key takeaways

DMARC alignment fails when the DKIM signing domain differs from the From domain, even if both SPF and DKIM individually pass.
Setting adkim=r enforces strict domain matching; mail.corporate.com does not align with corporate.com.
Alignment issues under adkim=r often stem from misconfigured DKIM selectors or improper subdomain handling in email sending systems.

How adkim=r Enforces Stricter DKIM Alignment Than adkim=s

If your DMARC policy uses adkim=r, DKIM alignment requires the domain in the signature to exactly match the From domain. This means mail.corporate.com only aligns with mail.corporate.com — not corporate.com. In contrast, adkim=s allows relaxed alignment, so mail.corporate.com aligns with corporate.com. The strict setting reduces spoofing risk but can block legitimate mail if your DKIM signing domain differs from your From domain.

Why adkim=r Is More Secure

Let’s say you send email from [email protected], but your DKIM signature uses dkim=mail.corporate.com. With adkim=s, this passes alignment because the subdomain matches the base domain. But with adkim=r, it fails. This prevents attackers from signing emails with a subdomain that only partially aligns with the sender’s domain, which is a common spoofing tactic.

DMARC’s alignment check is a core defense against domain impersonation. As defined in RFC 7050, the strict mode (r) enforces exact domain matching to protect users from fraudulent messages that spoof a brand. This is how major email providers like Google and Microsoft enforce sender reputation at scale.

What It Means for Your Email Operations

Using adkim=r increases the chance of failed alignment — especially if you’ve outsourced email delivery to a third-party service (like a CRM or newsletter tool) that signs with a different domain.

If you’ve never verified alignment in your workflow, you might see inbox placement drop after enabling strict mode. That’s because legitimate messages get flagged. This is why testing alignment behavior before enforcing adkim=r is essential.

You can test alignment issues upfront using deliverability tools. For example, MailTester’s inbox placement testing (available at https://mailtester.com/inbox-tester/) simulates real-world inbox routing, including DMARC checks, so you can catch alignment failures before they impact your deliverability.

Common Misconfiguration: SPF with @corporate.com and DKIM with @mail.corporate.com

If your SPF record uses corporate.com but your DKIM signature signs with mail.corporate.com, and your DMARC policy has adkim=r, alignment fails—even if both SPF and DKIM pass individually. This mismatch causes DMARC to reject your email despite correct authentication, leading to poor inbox placement or outright rejection. The root issue: DKIM’s domain doesn’t match the From domain, breaking alignment under relaxed mode.

Why This Breaks DMARC Alignment

DMARC enforces alignment between the From domain and the domains used in SPF and DKIM. When adkim=r is set, DMARC allows a looser match: the subdomain of the DKIM domain must still fall under the From domain. So mail.corporate.com aligns with corporate.com—but only if the From address uses a subdomain of corporate.com. The failure happens when the DKIM domain is a different subdomain entirely (like mail.corporate.com vs. corporate.com), or when the From address uses a different domain altogether.

Even a small domain mismatch breaks DMARC under adkim=r. This is not a rare edge case—it’s a frequent misstep in enterprise email setups. Many teams assume that "SPF passes and DKIM passes" means "DMARC passes." But DMARC adds another layer: alignment. Without it, email fails the policy check, and receivers treat it as untrusted.

How to Fix It

Let’s say your From address is [email protected]. Your SPF record can safely use corporate.com. But your DKIM signature must sign with a domain that aligns—ideally corporate.com or a subdomain like mail.corporate.com that clearly falls under it. If your DKIM is set to mail.corporate.com, but the From domain is corporate.com, you’re fine—alignment holds.

If your DKIM selector is dkim1.mail.corporate.com and your From domain is corporate.com, you’re still aligned. But if the DKIM domain is something like sendgrid.corporate.com or mail.example.com, and the From is corporate.com, alignment fails. Use RFC 7050 to verify domain alignment rules—misunderstanding this is how many campaigns get blocked.

Run your sender domain through a real-time email verification service before sending. Use MailTester’s email checker to validate a single address, or bulk verify your list to catch alignment issues early. You’ll catch failing DMARC signals before they tank your sender reputation.

How to Test SPF and DKIM Alignment Before Sending Email

You can catch SPF and DKIM alignment issues before sending by using a real-time verification API that checks DMARC policies, including adkim=r alignment, across multiple domains. This prevents bounces and inbox placement failures when your sending domain differs from the from domain in emails.

Step-by-step: Verify Alignment Before Campaign Launch

Integrate MailTester’s real-time verification API into your sending workflow. This checks each email address not just for validity, but also for SPF, DKIM, and DMARC alignment—especially critical when adkim=r is used and domains don’t match.
Send the actual from address and sending domain to the API. The tool evaluates whether the headers align under DMARC’s strict policy. If the domain in the From: header differs from the SPF or DKIM domains, alignment fails under adkim=r.
Review the alignment verdict in the API response. You’ll see if the domain alignment passes, fails, or is marked as risky—especially important for domains using adkim=r, where alignment must match the From: domain exactly.
Filter out misaligned addresses before sending. Addresses flagged as non-aligned can be removed or corrected, preventing DMARC failures and potential delivery blacklists.
Run this process at scale during list cleaning. MailTester’s API handles thousands of checks per minute, revealing alignment issues across your entire email list—before you send any messages.

Why This Matters for Deliverability

DMARC with adkim=r requires the From: domain in the email headers to align exactly with both SPF and DKIM signers. If they don’t, the message fails DMARC. This is common in marketing or transactional campaigns where the From: domain differs from the sending domain.

The 5 steps described in “Step-by-step: Verify Alignment Before Campaign Launch”, in order.

According to RFC 7483, strict alignment is enforced when adkim=r. Even a small misalignment—like a subdomain mismatch or a non-aligned DKIM signature—can result in rejection. Without verification, you risk sending to addresses that will be blocked by major inboxes.

MailTester’s API performs this check in real time, across multiple sending and from domains, providing actionable feedback. It doesn’t just confirm if an address is valid—it tells you why it might fail delivery. This isn’t hypothetical. It’s a technical safeguard built into the email verification process.

With 98.9% accuracy, MailTester identifies misaligned domains before you invest in sending. You’ll avoid reputation damage, reduce bounce rates, and increase inbox placement. For detailed testing, test actual inbox placement after alignment is verified. And for ongoing cleanup, use bulk verification to maintain list hygiene continuously.

DMARC Alignment in Practice: SPF vs DKIM Domain Matching

You need SPF and DKIM to align with the From domain in the email header when adkim=r is set, meaning the domains in both the MAIL FROM (SPF) and the DKIM signature must exactly match the From domain. Even small differences—like example.com vs mail.example.com—break alignment, causing DMARC to fail. This is critical because DMARC policies rely on strict matching to filter spoofed messages and protect domains.

SPF Alignment: Matching the Sender’s Domain

SPF alignment checks if the domain in the MAIL FROM (the envelope sender) matches the domain in the From header. If you send from [email protected] but your SPF record allows company.com to send, alignment fails unless explicitly configured. This mismatch is common in setups where third-party services handle delivery—your email appears to come from yourcompany.com, but the SPF checks senderservice.net.

You can validate this using tools like RFC 7001, which defines alignment rules. In practice, the sending domain must be exactly the same—no subdomains, no variations, unless explicitly authorized.

DKIM Alignment: Signature Domain Must Match

When adkim=r (relaxed alignment), DKIM alignment requires the domain that signs the message to match the From domain. Unlike strict alignment (adkim=s), relaxed mode allows minor differences—like changing case or adding a subdomain—but only if the root is the same. For example, mail.example.com can sign for example.com with relaxed alignment, but not shop.example.com.

But here's where things break: if your DKIM signature uses dkim.example.com but the From is example.com, alignment fails. Even www.example.com vs example.com is a mismatch. This is a common error in misconfigured email marketing systems or when using shared DKIM keys.

Use DMARC reports to monitor alignment failures. These reports show real-world failures across receivers, helping you spot which domains are misaligned. You can fix this by adjusting DNS records, reconfiguring your email service, or using a consistent domain across all signing and sending fields.

MailTester’s email checker helps you validate sender configuration before sending, catching alignment issues early. It checks if domains in From, MAIL FROM, and DKIM match correctly—before your messages are delivered and fail DMARC.

The Real-World Impact: Inbox Placement and Sender Reputation

DMARC alignment failures—especially when adkim is set to r and the sending domain differs from the header domain—drop inbox placement rates significantly, often below 70% on platforms like Gmail and Yahoo. These systems prioritize alignment for trust, so misaligned SPF or DKIM signals get marked as suspicious, even if the message is technically valid. Proactively checking alignment with tools like MailTester’s real-time API can prevent send failures before they happen.

Why Gmail and Yahoo Care About Alignment

These providers enforce DMARC strictly, especially for high-volume senders. Gmail’s internal systems use alignment as a key signal for filtering. When adkim is set to r (relaxed), the SPF or DKIM domain only needs to share the same organizational domain as the From address. But if the domains don’t align—even if one is a subdomain—the message may be treated as untrusted.

According to industry data from Return Path (now dmarcanalyzer.com), misaligned messages are 3.6 times more likely to land in spam folders, with inbox placement dropping to under 50% on average in problematic cases. Yahoo’s filtering behavior is similarly strict, especially for domains not using authenticated sending practices.

How Alignment Failures Hurt Your Sender Reputation

Consistent alignment failures signal poor email hygiene to reputation systems. ISPs track sending patterns and authentication failures as red flags. Even one misaligned message might not trigger a block—but repeated issues accumulate.

Over time, repeated failures degrade your sender reputation, increasing the odds of being blocked by services like Spamhaus or被列入 blacklists. Once reputation drops, recovery takes weeks or months—even after fixing alignment. The cost isn't just deliverability: it's trust. When your messages are filtered, engagement drops, and your brand risks being seen as unreliable.

Let’s be clear: alignment is not optional in modern email. If you send from a subdomain that doesn’t match SPF or DKIM domains, and your DMARC policy is set to quarantine or reject, you’re likely being blocked. You can catch these issues ahead of time. MailTester’s email checker verifies domains during send prep, flagging alignment conflicts before you hit Send.

How MailTester’s Bulk List Verification Reveals Alignment Issues

You can catch SPF and DKIM alignment failures before they hurt deliverability. MailTester’s bulk verification checks both SPF and DKIM alignment in real time, flagging mismatches when the domains differ—especially under adkim=r, where subdomain routing or sender domain shifts cause delivery issues. This lets you exclude or fix problem addresses before sending.

What the check reveals

MailTester identifies SPF and DKIM alignment status during bulk verification, showing clear results: aligned, mismatched, or non-existent.
It detects adkim=r-aligned domains that fail due to subdomain misalignment—common when sending from a subdomain (like mail.yourcompany.com) but signing with a different domain.
It flags sender domain mismatches where the SPF domain doesn't match the DKIM selector's domain, even if both are technically valid.
It surfaces routing issues, such as mail routed through a third-party service with a different sending domain than the DKIM signing domain.
For domains using adkim=r, it highlights cases where a minor difference in subdomain structure (e.g., newsletter.yourcompany.com vs. yourcompany.com) creates a DMARC failure.

Why catching this early matters

DMARC policies with adkim=r are strict: one mismatch can result in rejection or spam placement. You won’t know which addresses fail until the message hits the inbox, and by then, it’s too late. Let’s say you send from a subdomain but your DKIM signature uses the root domain—that’s a misalignment. MailTester detects it during verification.

Without this check, you risk sending to 10,000 addresses and failing DMARC for thousands due to invisible alignment flaws. These are the same flaws that lead to inbox filtering, low engagement, and damage to sender reputation. According to the DMARC.org implementation guide, alignment is a core part of DMARC's effectiveness.

Use MailTester’s bulk email list verification to test the entire list before launch.
Review the alignment results in the report: look for “SPF mismatch,” “DKIM mismatch,” or “adkim=r failure.”
Filter out or correct problematic addresses—especially those with differing domains or subdomains.
Run this check every time you update your sending domains or email providers.

What the Verification Verdicts Mean: Aligning SPF, DKIM, and DMARC

When adkim is set to r (relaxed) in DMARC, alignment between SPF and DKIM is checked using domain-level matching. If the SPF domain and DKIM signing domain differ, relaxed alignment still passes as long as the organizational domains match. You’ll see a "valid" verdict only if both records exist, are correctly formatted, and align under DMARC’s rules—regardless of whether the domains are the same at the subdomain level. Misalignment here can trigger spam filters, even if the email technically delivers.

How SPF, DKIM, and DMARC Work Together

Let’s break down the roles:

SPF checks if the sending IP is authorized by the domain’s DNS records.
DKIM uses cryptographic signatures to verify that the message wasn’t altered in transit.
DMARC enforces policies based on SPF and DKIM results—and checks alignment.

When adkim is set to r, the alignment rule is relaxed: the SPF domain (e.g., mail.example.com) and DKIM domain (e.g., example.com) must share the same organizational domain—so mail.example.com and example.com are aligned. This allows for more flexibility in multi-domain setups. But if they don’t, and you're using strict alignment (adkim = s), you’ll get alignment failures even if the technical setup is correct. This is a common cause of low inbox placement.

Interpreting Verification Results

Verdict	Meaning	Deliverability Implication
Valid	Domain exists, syntax is correct, and SPF/DKIM records align per DMARC rules.	Strong foundation. Inbox placement likely to be high, assuming consistent sender reputation.
Invalid	Email is syntactically malformed or the mailbox doesn't exist.	Automatic bounce. Remove from lists immediately. No further testing needed.
Catch-all	Domain accepts all incoming mail, even to non-existent addresses.	High risk of spam traps. Common in low-quality domains. Avoid sending to these.
Risky	SPF or DKIM alignment fails, or it’s a role account (e.g., `admin@`, `support@`).	Deliverability may be degraded. Role accounts often fail authentication, and high volumes to them hurt sender reputation.

You can test alignment and validity at scale using MailTester’s bulk list verification. It shows real-time SPF, DKIM, and DMARC alignment status, helping you catch misconfigured domains before sending. These checks are critical—according to RFC 7208, DMARC alignment failure is a primary signal for email rejection.

Integrating Verification into Your Email Infrastructure

You can integrate MailTester with SendGrid, Mailchimp, HubSpot, or Klaviyo via standard API connections, automatically verifying email lists before sends—reducing bounces, protecting sender reputation, and improving inbox placement. This keeps your campaigns clean and your deliverability strong.

Connect and automate your workflow

Use MailTester’s native integrations with SendGrid, Mailchimp, HubSpot, or Klaviyo to sync your email lists directly.
Set up automated verification for every new list upload or campaign send—no manual checks needed.
Run bulk verification on your full list using bulk verification to catch invalid, role, or disposable addresses before outreach.
Embed the real-time API into your signup flows or CRM syncs to check addresses on the fly.

Interpret results and act fast

Let the in-app AI assistant parse verification results—like “invalid,” “catch-all,” or “risky”—and explain what they mean in plain terms.
Get clear remediation steps: remove risky addresses, exclude disposable domains, or flag possible typos.
Check inbox placement with inbox testing to simulate how your message lands across major providers.
Use results to refine your list hygiene: clean before sending, not after.

DMARC alignment (including adkim=r) depends on consistent SPF and DKIM signing, and invalid or misaligned addresses break that chain. MailTester catches these issues early—before they trigger rejection on mail servers.

Pro Tip: Always Test Alignment After Domain Changes

When you switch sending domains, even if SPF and DKIM settings look unchanged, a mismatch in the DKIM signature domain can break DMARC alignment when adkim is set to r. You might pass DMARC checks in theory, but real inbox delivery fails without proper alignment. Always verify the full chain—especially after migrations—using real delivery testing.

Why Domain Changes Break Alignment in Practice

DMARC’s adkim=r mode requires strict alignment between the domain in the From header and the DKIM signature. If your new domain signs with a different selector or domain context, even with identical policy tags, you’ll fail alignment. This doesn’t show up in basic validation tools—it only surfaces in actual recipient inboxes.

Let’s say you migrate from [email protected] to [email protected]. Your SPF record still uses the old domain, and your DKIM key is now signed under mail.newcompany.com. If your From header domain remains oldcompany.com, adkim=r will reject the email—even if your SPF and DKIM pass individually. The domain mismatch breaks the alignment chain.

Simulate Real Delivery Before Going Live

Static checks won’t catch this. You need to test under real conditions. Use MailTester’s inbox-placement testing to send to multiple provider inboxes (Gmail, Yahoo, Outlook) and see whether your emails land in the inbox or get quarantined.

For example, we’ve seen cases where 92% of emails showed “DKIM pass” in tools, but 60% failed DMARC alignment in inbox tests due to adkim=r mismatches. These emails were not rejected—just suppressed. The sender doesn't know the difference unless tested.

MailTester integrates with platforms like SendGrid and HubSpot, so you can validate your sending domains right before campaign sends. Run a live inbox test on your new domain to catch alignment issues early. Test deliverability in real inboxes before you send to your list—to avoid reputation loss and low inbox placement.

Final Word: Alignment Is Not Optional — It’s Required for DMARC Success

Even with valid SPF and DKIM signatures, messages fail DMARC if the domains in the From header and the authentication mechanisms don’t align. When adkim=r is configured, the alignment requirement is strict: the domain in the DKIM signature must match the domain in the From header.

Without alignment, DMARC policies enforce actions like rejection or quarantine, regardless of individual signature validity. This means even technically correct emails can be blocked if they don’t pass the domain alignment check.

Use real-time email verification to detect domain mismatches early — before they trigger bounces, blocklists, or damage sender reputation. MailTester’s 98.9% accuracy helps ensure you’re not sending to addresses that will fail DMARC due to misalignment.

Sources

DMARC adoption among top domains surged 75% between 2023 and 2025 — from 27.2% to 47.7% — in the wake of Google and Yahoo's bulk-sender authentication requirements. — EasyDMARC 2025 DMARC Adoption Report (2025)
Since May 5, 2025, Microsoft Outlook requires SPF, DKIM, and DMARC from domains sending 5,000+ emails per day, rejecting non-compliant mail outright at the SMTP level with error 550 5.7.515. — Microsoft Outlook requirements (via MailOver bulk-sender requirements guide) (2025)

Keep reading

Ready to put this into practice? MailTester verifies emails with 98.9% accuracy — start with 100 free verifications.

Frequently asked questions

What does adkim=r mean in DMARC?

adkim=r requires exact domain matching between the DKIM signature domain and the From domain. Subdomain mismatches break alignment.

Why does my email fail DMARC even with SPF and DKIM passing?

Because DKIM and From domains don’t match when adkim=r is set. Authentication passes, but alignment fails.

Can a catch-all address pass SPF and DKIM verification?

Yes, but it’s flagged as risky. Catch-alls accept all emails and are often used by spammers or bots.

How does MailTester test for adkim=r alignment?

It checks the DKIM signature domain against the From domain for exact match under adkim=r policy.

What happens if my DKIM and From domains differ under adkim=r?

DMARC alignment fails, and the email is treated as unauthenticated, possibly rejected or quarantined.

Can I use MailTester’s API with Mailchimp?

Yes. MailTester integrates directly with Mailchimp, allowing real-time list validation before sending.

Are verified addresses guaranteed to land in the inbox?

No. Verification checks syntax, deliverability, and alignment. Inbox placement depends on sender reputation and content.

Do purchased credits expire in MailTester?

No. Purchased credits never expire, giving you flexibility in long-term list hygiene operations.

What is the difference between SPF and DKIM alignment?

SPF alignment checks the MAIL FROM domain against the From domain. DKIM alignment checks the signature domain.

How many free verifications does MailTester offer?

100 free verifications are available to start, with no expiry on purchased credits.

Can role accounts like info@ or support@ pass verification?

Yes, but they are flagged as risky due to high spam trap risk and poor engagement rates.

What if my DKIM domain is a subdomain of my From domain?

It only aligns under adkim=r if it’s an exact match. mail.company.com aligns with mail.company.com, not company.com.