Check alignment
In Gmail: open the message → three dots → Show original → copy everything above the body. The From, Return-Path, DKIM-Signature and Authentication-Results lines are what matter.
How it works
Parse
Headers are unfolded and the From:, Return-Path:, DKIM-Signature: and Authentication-Results: lines are read. Multiple signatures are all evaluated.
Policy
The DMARC record for the From domain is fetched over DNS — falling back to the organisational domain for subdomains — to get the real adkim and aspf tags.
Align
Each identifier is compared with the From domain: exact match for strict, same organisational domain for relaxed.
Verdict
DMARC passes if at least one identifier both authenticated and aligned. The table shows which did, and the notes say what to change.
The fault this finds
The most common DMARC question I get is some version of "SPF passes, DKIM passes, DMARC fails — how?" The answer is always alignment. SPF and DKIM each authenticate a domain, but not necessarily the one in the From: header. SPF checks the envelope sender, which for most sending tools is the tool's bounce domain. DKIM checks whichever domain signed the message, which by default is the tool's or the provider's. Both can pass with flying colours while the From domain sits there unauthenticated, and DMARC — which only cares about the From domain — fails.
Relaxed and strict
Relaxed alignment, the default, accepts a match on the organisational domain: send.acme.co aligns with acme.co and with mail.acme.co. Strict requires the exact domain. Almost nobody needs strict, and setting aspf=s is the fastest way to break a fleet that sends from subdomains with the bounce address on the root. This tool fetches the actual tags rather than assuming, because I have lost hours to a strict tag someone set two years ago.
Why DKIM alignment matters more
SPF alignment is lost the moment the message is forwarded, because the forwarding server becomes the envelope sender. DKIM alignment survives forwarding, mailing lists that do not rewrite the body, and most Outlook rules. A message that passes DMARC on SPF alone is fine on direct delivery and fails everywhere else. If the table shows SPF aligned and DKIM not, the fix is a DKIM key on your own domain — every sending tool supports it, and the DKIM generator makes the record.
Reading Authentication-Results
The receiver's verdict line is the authoritative source when present, because it reflects what that server actually saw at SMTP time. This tool reads it for SPF and DKIM results and then does its own alignment arithmetic, so you can see the reasoning rather than just the outcome. When the two disagree, trust the receiver and look for headers you did not paste — the first Received: line and the Return-Path are often missing from copied fragments.
Frequently asked questions
Why does DMARC fail when SPF and DKIM both pass?
Because neither pass was for the From: domain. SPF authenticated the envelope sender (usually the tool's bounce domain) and DKIM authenticated the signing domain (usually the provider). DMARC needs one of them to align with the From: domain.
What is the difference between relaxed and strict alignment?
Relaxed accepts any subdomain of the same organisational domain. Strict requires the exact domain. Relaxed is the default and almost always what you want.
Does the tool verify the DKIM signature cryptographically?
No — it cannot without the message body. It reads the receiver's Authentication-Results for the pass/fail and works out the alignment. Paste the full headers so that line is included.
Where do I get the headers?
Gmail: open the message, three dots, Show original. Outlook: File → Properties → Internet headers. Copy everything above the first blank line.
My From is a subdomain — which DMARC record applies?
The receiver looks for _dmarc on the exact From domain first. If there is none, it uses the organisational domain's record and the sp tag if present. This tool does the same lookup.
Last reviewed
What to run next
The checks that most often follow this one.
More in this category
Guides that go deeper
When the tools tell you something is wrong
The diagnostics here are free and always will be. When the fix is bigger than a DNS record, this is the work I do.
Deliverability rescue
Mail landing in spam, replies gone quiet, or a domain suddenly blocked. I find the actual cause rather than guessing, and fix it.
- Authentication and alignment failures
- Blocklist delistings and reputation repair
- Gateway and filter-level blocks
- A written report on what broke and why
Email & sending infrastructure
Sending domains, inboxes, authentication and warmup, built to survive volume instead of burning down in a month.
- Domain and inbox fleets at any scale
- SPF, DKIM, DMARC and tracking domains
- Google Workspace — Silver Partner
- Handover documentation you actually own
Domain, DNS & migration
Changing registrar, mail provider or host without a day of downtime or a week of mail silently failing.
- Registrar and nameserver moves
- Workspace and Microsoft 365 migrations
- MX, SSL and subdomain cutover
- Staged rollout with rollback at every step
Monitoring & retainer
Infrastructure drifts. Records get edited, certificates expire, domains get listed. Ongoing eyes on the fleet.
- Scheduled checks across every domain
- Alerts before your clients notice
- Monthly reporting
- Priority response when something breaks
Start with a call
Bring a domain and the symptom. I will tell you what is actually wrong and whether you need me at all — plenty of people leave that call able to fix it themselves.
Thirty minutes, no pitch
We will run the checks together on your actual domains, and you will leave knowing what is broken, what it takes to fix, and what it should cost. If that is a job you can do in-house, I will say so.