SPF passed. Why is it not aligned?
On every plan
Because it passed for a different domain. DMARC does not ask whether SPF or DKIM passed. It asks whether one of them passed for the domain in the From address, the one people see. That match is called alignment. A sending service often passes SPF for its own bounce domain, which is not yours, so SPF passes and still does not count for DMARC.
For what SPF, DKIM and DMARC each check, read SPF, DKIM and DMARC together. This page says how the product decides alignment and where it shows it.
When each one aligns
- DKIM aligns when a signature passes and the domain in its
d=tag matches the From domain. - SPF aligns when SPF passes and the domain it checked matches the From domain. SPF checks the envelope sender, the address bounces go to, which is often the service's own.
- DMARC passes when at least one of the two aligns.
Relaxed and strict
Your DMARC record says how close the match must be: adkim for DKIM, aspf for SPF.
- Relaxed,
r, the default. Both domains share the same organizational domain, which we work out with the Public Suffix List.news.example.comaligns withexample.com, andshop.example.co.ukwithexample.co.uk. Butexample.co.ukdoes not align withother.co.uk, becauseco.ukis a public suffix that many owners share. - Strict,
s. The two names are identical:news.example.comdoes not align withexample.com.
The record the product suggests keeps what your current record says, and uses relaxed when it says nothing. When your record asks for strict, the DMARC check on the DNS tab notes it, because strict fails mail that relaxed would pass.
Where the product shows it
The Sources page has an SPF column and a DKIM column, each with one word for the source's mail in the chosen period:
| Word | What it means |
|---|---|
| aligned | All of it aligned with your domain. It counts for DMARC. |
| aligned for 93 % | Part of it aligned: here 93 percent of the messages, rounded down, so 100 percent shows only as "aligned". Below one percent, it reads "aligned for under 1 %". The part that did not align does not count. |
| passes for another domain | None of it aligned, but it passed for some domain, usually the service's own. It does not count. |
| error | Nothing passed, and the check could not finish, such as on a broken SPF record. |
| none | There was nothing to check, such as mail with no DKIM signature. |
| fails | It was checked and failed. |
We show alignment beside the plain SPF and DKIM results because alignment is what DMARC tests. A source can pass SPF in every report and still fail DMARC.
Whose result counts
Each report row carries the mailbox provider's own verdict on DKIM and SPF alignment, and we use it when it is there. We also work alignment out from the raw results. When the two disagree, the provider's verdict counts, and the source's explanation says so. See how we explain each source.
Making a source align
The usual fix is to have the service sign DKIM with your own domain. Forwarding breaks SPF, so mail that aligns only through SPF fails once someone forwards it. With DKIM aligned, it survives forwarding. The source's explanation names the action, and its guide shows the steps for that service.
Published 27 October 2026 · Checked 27 October 2026