Why are emails marked DMARC permfail when SPF and DKIM pass?

You sent a perfectly formatted email. SPF and DKIM both pass. The sender’s domain looks legitimate. Yet the recipient’s inbox flags it as DMARC permfail. That’s frustrating — especially when you’ve double-checked your setup.

Here’s the truth: authentication isn’t just about passing checks. It’s about alignment. SPF and DKIM confirm the message came from an authorized source. But DMARC enforces that the domain in the "From" header matches the domain used in SPF or DKIM.

If they don’t align, DMARC rejects the email — even if SPF and DKIM are technically valid. That’s why you see permfail: the domain alignment failed, regardless of the underlying authentication success.

Key takeaways

  • DMARC permfail occurs when the 'From' domain doesn’t align with the SPF or DKIM domain, even if both authentication methods pass.
  • SPF and DKIM validate sender legitimacy; DMARC enforces domain alignment between the sender’s domain and the authenticated domain.
  • Misalignment is common with third-party email services, shared sending domains, or poorly configured email forwarding setups.

How DMARC, SPF, and DKIM work together in email verification

DMARC permfail occurs when SPF and DKIM pass but the domain alignment fails. DMARC checks whether the domain in the From header matches the domain used in SPF or DKIM. Even with valid authentication, mismatched domains trigger a permfail. This signals a potential spoofing risk and often leads to delivery issues.

Why alignment matters

SPF, DKIM, and DMARC each serve distinct, overlapping roles in email authentication. Let’s break them down.

System What It Checks How It Works Impact on Verification
SPF (Sender Policy Framework) Whether the sending server is authorized by the domain’s DNS records Checks the IP address of the sending server against a list published in the domain’s DNS TXT record A mismatch here causes soft or hard fail. Valid SPF doesn’t guarantee inbox placement, but invalid SPF often does.
DKIM (DomainKeys Identified Mail) Whether the message content was altered in transit Uses cryptographic signatures attached to each email, validated against a public key in DNS A passed DKIM means the email hasn’t been tampered with. If a signature fails, the message may be rejected.
DMARC (Domain-based Message Authentication, Reporting & Conformance) Whether the From domain aligns with SPF or DKIM domains Enforces alignment between the From header and either SPF’s sender or DKIM’s signing domain This is where permfail occurs. Even if SPF and DKIM pass, a domain mismatch triggers DMARC failure.

For example, if an email claims to come from [email protected] but the SPF check passes for mail.company.net, DMARC will flag this as a domain alignment issue — even if both SPF and DKIM are valid.

DMARC policies can be set to none (monitor-only), quarantine (send to spam), or reject (block). Most enterprises use quarantine or reject, meaning even a permfail can result in the email being blocked.

You can test this in practice: run your sender domain through DMARCian’s lookup tool or use MxToolbox to analyze your DNS records and DMARC policies. These tools help you diagnose why a DMARC permfail is triggered.

When verifying your list with tools like MailTester, you’re not just checking syntax or delivery status — you’re validating whether each address meets the security and alignment expectations of modern email systems. Our bulk verification checks for these signals, including alignment, to help you prioritize addresses with better deliverability potential.

Common causes of DMARC permfail despite valid SPF and DKIM

You’re seeing DMARC permfail even when SPF and DKIM pass because DMARC checks alignment between the domain in the From header and the domains used in SPF (sender) and DKIM (signer). If those domains don’t match—due to mismatched sender domains, shared ESP infrastructure, forwarding, or legacy domains—DMARC fails, regardless of SPF/DKIM validity. Let’s break down what actually causes this.

Domain misalignment in From vs. SPF/DKIM

  • Using a non-aligned domain in the From header, like [email protected] with SPF set on mail.yourcompany.com, breaks alignment even if SPF passes.
  • Many organizations use third-party marketing services where the From domain differs from the authenticated domain in SPF—this is a common root cause of alignment failures.
  • Let’s say your email comes from [email protected], but your SPF record only applies to send.company.com. Even with valid SPF and DKIM, DMARC will permfail due to lack of alignment.

Shared infrastructures and forwarding complications

  • When you use an email service provider (ESP) like SendGrid or Mailchimp, SPF is often aligned to a subdomain (e.g., mail.sendgrid.net), but your From domain may be [email protected]. Unless properly configured, this causes misalignment.
  • Forwarding services (e.g., Gmail, Yahoo) sometimes alter the From domain while preserving the original DKIM signature. The DKIM signature remains valid, but the From domain no longer matches the signer domain—DMARC fails.
  • Legacy sender domains—those no longer used for active mail—are sometimes reappeared in From headers due to old templates or systems. Even if the SPF/DKIM are valid, DMARC fails because the domain is no longer associated with the sending infrastructure.

DMARC’s alignment requirement is strict: the domain in the From header must match the domain used in SPF (sender) or DKIM (signer). This isn’t about whether the email is technically authenticated—it’s about trust in sender identity.

Even if SPF and DKIM validate successfully, the absence of domain alignment is sufficient for DMARC to reject a message as permfail. This is enforced by RFC 7052 and observed across major inboxes like Gmail and Microsoft, where alignment is mandatory for pass.

Use real-time email verification to test how your From domain aligns with authenticating domains before sending. This helps catch misaligned setups early—before they damage your sender reputation.

For deeper technical context, see RFC 7052, which defines how DMARC alignment works in practice.

How DMARC alignment works in practice

DMARC permfail happens even when SPF and DKIM pass because DMARC checks if the domain in the From header aligns with the domain used in SPF or DKIM authentication. If you send from [email protected] but SPF validates using [email protected], the domains don’t match — alignment fails, and DMARC blocks the email. This alignment is strict: subdomains like [email protected] don’t align with yourcompany.com unless explicitly configured.

Why domain alignment is non-negotiable

DMARC isn't just about authentication — it's about trust in identity. Even if your email passes SPF (sender is on allowed IP) and DKIM (message wasn't altered), DMARC fails if the domains don’t align. This is intentional. It stops email spoofing even if an attacker has valid SPF or DKIM setup under a different domain.

For example, if your mail server is at [email protected] but the From address is [email protected], alignment fails. The receiving server sees a mismatch and treats it as a policy violation — even if SPF and DKIM checks pass. This is why alignment is often the root cause of DMARC failures, especially in large or complex email setups.

How to fix alignment issues

Let’s say you send from [email protected], but your SPF validates using [email protected]. The domains differ, so alignment breaks. The fix is to make sure the From domain matches either the SPF or DKIM domain — or configure your DMARC policy to allow relaxed alignment where needed.

Many organizations use different domains for sending and receiving, which creates confusion. Using a single, consistent domain for both From and authentication avoids this. You can also use spf-all or dkim-all if you're running a large-scale email system and need flexibility.

DMARC alignment is enforced by receivers like Gmail and Microsoft. You can test your alignment in real time by sending your email to a DMARC-enabled inbox tester to catch issues before sending to your full list.

For bulk senders, pre-checking each address for validity and deliverability helps. Use the MailTester bulk verification tool to find outdated, mistyped, or invalid emails — including those that might trigger DMARC permfail due to poor setup or forwarding issues.

Step-by-step diagnostic process for DMARC permfail

DMARC permfail happens when SPF or DKIM pass but alignment fails—meaning the domain in the From header doesn’t match the domain in the SPF or DKIM validation. This can still trigger rejection, even if authentication checks out. The root cause is usually a mismatch between the sending domain and the display domain. Let’s walk through how to spot it.

Check the full email header for alignment issues

  1. Open the full email header in your email client or use a tool like MxToolbox or RFC 7001 to decode it. Look for Received-SPF, DKIM-Signature, and From fields.
  2. Compare the From domain with the SPF-aligned domain. If your message shows From: [email protected] but SPF passes for company-b.com, alignment fails.
  3. Check the DKIM-Signature header to see which domain actually signed the message. It will include a d= parameter—this tells you the domain used for DKIM. If that’s different from the From domain, you’ve found misalignment.
  4. Verify domain alignment. DMARC requires either SPF or DKIM alignment. If the signing domain doesn't match the From domain, even a passing SPF or DKIM result will lead to a permfail.
  5. Review your sending workflow. Are you using a transactional domain (e.g., [email protected]) but displaying [email protected]? This mismatch causes permfail. Use consistent domains or set up proper alignment via SPF and DKIM records.

Common causes and fixes

Alignment failure often appears when using a service like SendGrid or Mailgun with a different sending domain than the display domain. For example, if you send from [email protected] but show From: [email protected], alignment fails unless properly aligned via SPF or DKIM.

Let’s say the From domain is [email protected], but SPF only passes for send.yourbusiness.com. The SPF record must explicitly include that subdomain, or else the alignment fails. Use DNS lookup tools to validate SPF and DKIM records.

If you’re not sure which tool to check headers, MailTester’s email checker can analyze a real email header and surface alignment issues, including DMARC results, without requiring a full send.

Why SPF and DKIM pass but alignment still fails

You can pass SPF and DKIM checks but still fail DMARC alignment if the domains in those headers don’t match the “From” domain the recipient sees. SPF and DKIM authenticate the sender and message integrity, but they don’t require the sending domain to match the From domain. If the email uses a different domain in the envelope (SPF) or header (DKIM), DMARC flags it as a misalignment — even if both technical checks pass.

SPF and DKIM: What They Actually Validate

SPF checks whether the sending IP is authorized to send on behalf of the domain in the envelope sender (Return-Path). DKIM verifies the message wasn’t altered in transit using a digital signature tied to a sending domain. Both confirm authenticity at the technical level.

But here’s the catch: SPF uses the Return-Path, and DKIM uses its own selector and domain — these aren’t necessarily the same as the “From” address in the header. That’s why one can pass both checks and still fail alignment.

DMARC: The Alignment Enforcement Layer

DMARC isn’t about proving who sent the email — it’s about making sure the domains that claim to send it are consistent. It requires either SPF or DKIM alignment with the From domain. If they don’t align, the email fails DMARC — regardless of whether SPF or DKIM passed individually.

For example, if you send from [email protected] but your SPF checks against senderservice.com and DKIM signs with mailrelay.net, DMARC will reject it, even if SPF and DKIM both pass. This stops spoofing attempts where attackers use legitimate sending mechanisms but misrepresent the sender.

According to the DMARC specification (RFC 7483), alignment ensures trust between the sender identity and the technical authentication. This is why DMARC is a final gatekeeper in modern email security.

Want to test email deliverability before sending? Use MailTester’s inbox placement checker to see how your emails behave across major providers, including alignment behavior.

How to fix DMARC permfail with alignment correction

DMARC permfail occurs when SPF or DKIM pass but the domain alignment fails—typically because the From domain doesn’t match the domain used in SPF or DKIM. Fix it by ensuring all authentication mechanisms use the same domain, especially if using third-party services or forwarding. Alignment is mandatory for DMARC to pass.

Core fix: Align your sending domain across authentication

  • Use the same domain in the From header that’s listed in your SPF record and used to sign the message via DKIM.
  • If sending via SendGrid, Mailgun, or similar services, ensure the From domain matches the domain authorized in your SPF record.
  • Never use a different domain in the From header than the one used for SPF or DKIM—it breaks alignment and triggers DMARC permfail.
  • Always verify your SPF, DKIM, and DMARC records align using tools like MXToolbox or dmarcanalyzer.com, which check alignment at the protocol level.

Handling forwarders and third-party senders

  • If forwarding messages through services like Gmail or an email relay, configure the service to preserve the original authentication headers or re-sign the message with the correct domain.
  • Use a consistent sending domain across every system: your CRM, newsletter platform, transactional email system, and support tools.
  • When using multiple services, avoid mixing domains—e.g., don’t send from [email protected] while authenticating with send.yourcompany.com in SPF.
  • Test your setup with tools like MailTester’s inbox placement tester to check if your messages pass DMARC and land in inboxes—not spam folders or quarantines.

Alignment is not optional. It’s baked into DMARC’s validation logic. Even if SPF and DKIM pass individually, misalignment causes DMARC to fail. The fix isn’t in adding more records—it’s in ensuring consistency across domains.

“DMARC alignment is the backbone of email authenticity. Misalignment is the most common reason for DMARC fails—even when SPF and DKIM pass.”

For teams verifying large lists, use MailTester’s bulk verification to spot invalid, catch-all, or role-based addresses early—before they hurt sender reputation and trigger deliverability issues like DMARC failures.

You're seeing DMARC permfail even when SPF and DKIM pass because the authentication headers aren’t aligned—meaning the domains in the From: header don’t match the domains used in SPF (envelope-from) or DKIM (domain-signature). This mismatch triggers DMARC policy enforcement, even if the technical checks pass. MailTester helps you catch these alignment issues before they hurt deliverability by validating both technical authenticity and domain alignment.

Proactive Checks to Prevent DMARC Failures

  • Use MailTester’s real-time API to bulk verify your sender list and flag invalid, catch-all, or risky email addresses that may trigger authentication anomalies. Verify your list at scale before sending.
  • Run inbox-placement tests to simulate how your emails perform in real inboxes across providers like Gmail, Outlook, and Apple. These tests include tracking whether your messages are blocked or flagged due to DMARC alignment failures.
  • Check email headers after sending using the in-app AI assistant. It parses complex headers (including SPF, DKIM, and DMARC results) and explains whether domain alignment exists—especially critical for DMARC-permfail conditions caused by mismatched identities.
  • Integrate MailTester directly with SendGrid, Mailchimp, HubSpot, or Klaviyo via pre-built connectors. These integrations validate the email list and deliverability risk before sending, ensuring only compliant, high-quality addresses are reached.

Why Alignment Matters at Scale

DMARC policies rely on alignment between the From: domain and the domains used in SPF (envelope sender) and DKIM (signed domain). A common setup is sending from [email protected] with SPF aligned to mail.yourcompany.com, but DKIM signed with sendgrid.net—this causes misalignment even if both SPF and DKIM pass. This can look like a "pass" to basic checkers but fails DMARC.

Tools like MailTester analyze actual headers and flag alignment issues before you waste sends. RFC 7672 outlines DMARC’s alignment rules, and even minor gaps—like a subdomain mismatch or unexpected third-party signing domains—can result in permfail. Real-world evidence from providers like Microsoft and Google shows that DMARC-aligned messages have significantly higher inbox placement than misaligned ones.

Use MailTester’s inbox placement tests to simulate delivery outcomes across providers and see DMARC results upfront. This is not about guessing— it's about seeing the actual outcome before your campaign goes live.

What happens if DMARC permfail goes unaddressed?

If your emails pass SPF and DKIM but still get marked DMARC permfail, they’re likely to be treated as suspicious by inbox providers—even if they’re technically valid. This can lead to inbox placement issues, spam folder delivery, or outright rejection. Over time, repeated failures hurt sender reputation, especially at scale. High-volume senders risk being flagged by monitoring services or blocked entirely. Let’s break down what actually happens when you ignore the signal.

How DMARC permfail impacts deliverability

  • Even with valid SPF and DKIM, a DMARC permfail means the policy explicitly rejected the message. Major providers like Gmail and Outlook act on this policy, often diverting mail to the spam folder or rejecting it silently.
  • DMARC is not just a diagnostic tool—it’s a gatekeeper. If your domain’s DMARC policy is set to reject or quarantine, and a message fails alignment, delivery is blocked by design.
  • Receiving mail servers use DMARC as a trust signal. A consistent pattern of permfail, even on valid messages, reduces confidence in your sender identity. This degradation accelerates with volume.
  • If your email infrastructure isn't properly aligned—e.g., your SPF covers the sending domain but not your mail relay’s domain—DMARC will fail even if the other checks pass. This misalignment is common.

Why reputation damage escalates

  • Reputation is built on consistency. A single DMARC failure might not break a good reputation, but repeated failures do. Spamhaus and other monitoring services track these patterns, and high failure rates trigger alerts.
  • High-volume senders—especially in marketing or transactional workflows—are actively monitored. Tools like Spamhaus and MXToolbox can flag domains with consistent DMARC issues, increasing the chance of being blacklisted.
  • Even if you're not on a blocklist yet, inbox providers increasingly use DMARC results as input to their filtering decisions. A history of permfail is a red flag.
  • Fixing DMARC issues often requires auditing your email sending setup. You can’t just rely on having SPF and DKIM in place—alignment matters.

Use MailTester’s email checker to quickly test if an address can receive your email with all authentication layers intact. It shows real-time results across SPF, DKIM, and DMARC. For bulk senders, bulk verification helps identify entire lists at risk. The platform doesn’t just confirm validity—it flags misalignment issues that lead to DMARC permfail.

How to test DMARC alignment before sending in bulk

DMARC permfail happens even when SPF and DKIM pass because the domains in the From header don’t align with the signing domains. This means the email passes cryptographic checks but fails the policy enforcement due to mismatched identities. Use real inbox testing and pre-send verification to catch alignment issues early—before bulk sends, when fixes are easiest.

Verify sender domains and addresses before sending

  • Run your entire list through MailTester’s bulk verification to flag addresses with catch-all, role, or disposable domains—these often trigger DMARC permfail due to ambiguous ownership.
  • Check each sender domain (e.g., yourcompany.com in the From header) against the domain used in SPF and DKIM signatures. Misalignment here causes permfail even with valid authentication.
  • Ensure consistent use of the same domain across all sending sources. Mixing domains (e.g., [email protected] vs. [email protected]) without proper DMARC policy setup increases alignment risk.

Test delivery under real-world inbox conditions

  • Use MailTester’s inbox-placement test to send a sample message to major inboxes (Gmail, Outlook, Yahoo). This reveals if DMARC alignment is causing rejection or tagging—even if SPF/DKIM pass.
  • Review the detailed deliverability report to pinpoint whether DMARC policy enforcement is blocking your message, or if it’s landing in spam with a DMARC-related header.
  • Enable feedback loops (FBLs) and monitor spam complaint rates. A sudden spike in complaints, even with valid SPF/DKIM, can signal misconfigured DMARC policies or unexpected sender identity use.
  • Consider using MailTester’s real-time API to validate each address in your campaign workflow, especially when sending from dynamic or shared IPs.
DMARC permfail isn’t about failed authentication—it’s about trust. A message might pass checks, but if the visible From domain doesn’t match the signed one, receivers reject it. Prevention is better than remediation.

According to the DMARC specification (RFC 7052), alignment is mandatory for policy enforcement. You can't assume SPF or DKIM passing means delivery is guaranteed. Testing with real inbox conditions and verifying domain consistency is the only reliable way to avoid permfail in production.

Summary: DMARC permfail ≠ failed authentication

SPF and DKIM passing means the message is authenticated at the technical level. The sender’s domain was verified by the receiving server using established protocols.

DMARC permfail indicates that the From domain does not align with the domain used in SPF or DKIM. This mismatch triggers the DMARC policy, even though authentication itself succeeded.

How to fix alignment issues

  • Ensure the From domain matches the domain used in SPF and DKIM records.
  • Use the same domain consistently across all email systems, especially when using ESPs, forwarding services, or email templates.
  • Verify sender configurations in tools like MailTester before sending to catch misalignment early.

Sources

Keep reading

Ready to put this into practice? MailTester verifies emails with 98.9% accuracy — start with 100 free verifications.

Frequently asked questions

What does DMARC permfail mean?

DMARC permfail means the email failed domain alignment — the 'From' domain doesn’t match the domain used in SPF or DKIM authentication, even if both checks passed.

Can SPF and DKIM pass but DMARC still fail?

Yes, SPF and DKIM can pass while DMARC fails due to domain misalignment. Alignment is required for DMARC to pass.

How do I check if my email has DMARC permfail?

Inspect the full email header for the 'DMARC-Result' field and check the 'From' domain against the SPF and DKIM authentication domains.

Why does my email show DMARC failure even though I have valid SPF and DKIM?

Because DMARC enforces alignment between the 'From' domain and the authenticated domain. A mismatch triggers permfail.

Can a forwarded email cause DMARC permfail?

Yes, forwarding services often change the 'From' domain without re-signing the message, breaking alignment and causing permfail.

How can I fix DMARC permfail with a third-party ESP?

Ensure the 'From' domain matches the domain used in the ESP’s SPF or DKIM configuration. Use consistent sender domains across systems.

Does MailTester detect DMARC permfail?

MailTester doesn’t check DMARC alignment directly in real-time verification, but its deliverability tests can surface alignment issues during inbox placement simulations.

What is domain alignment in DMARC?

Domain alignment requires that the 'From' domain matches the domain used in the SPF or DKIM authentication results — strict matching is required.

Do all emails need to pass DMARC?

For better inbox placement and sender reputation, yes. DMARC permfail increases risk of rejection or spam filtering, even with valid SPF and DKIM.

Can I use different domains for SPF and DKIM?

Yes, but the domain alignment must still match the 'From' address. If the 'From' domain doesn’t align with either the SPF or DKIM domain, DMARC fails.

How does MailTester improve email deliverability?

MailTester’s 98.9% accurate verification and inbox-placement testing help catch invalid, risky, or misaligned addresses before sending.

Is DMARC alignment required for all emails?

DMARC policies are enforced by receivers. Alignment is required to meet DMARC requirements and avoid rejection or spam placement.