Your email passes SPF and DKIM but still fails DMARC. Here's why

Your email passes SPF and DKIM but still fails DMARC. Here's why

You set up SPF. You set up DKIM. You send a test message and both come back pass. Then your DMARC reports show fail, or a receiver quarantines the mail anyway. It reads like a contradiction, and it's the single most common DMARC question I run into.

The short version: DMARC doesn't care that SPF or DKIM passed. It cares that they passed for your domain, the one in the From address your recipient actually sees. That extra requirement is called alignment, and it's where almost every "passes auth but fails DMARC" case lives.

What DMARC actually checks

SPF and DKIM each authenticate a domain, but not always the domain you'd assume.