# SPF and DKIM pass, but DMARC fails. What now?

> A fictional newsletter example shows why passing SPF and DKIM can still leave the visible From domain unauthenticated.

By [CheckDMARC](https://checkdmarc.mx/). Published: 2026-11-06. Reviewed: 2026-11-06.

## Start with three domains, not three green labels

Imagine a newsletter with From: news@sender-example.test. Its provider reports SPF pass for bounce@mailer-example.test and DKIM pass with d=mailer-example.test. This is a fictional troubleshooting example, not a measurement of a real sender.

Both mechanisms can pass for the provider while neither aligns with the sender’s From domain. DMARC needs a passing, aligned identity.

The identities in this example
| Identity | Domain | Aligned with From? |
| --- | --- | --- |
| Visible From | sender-example.test | Reference domain |
| SPF envelope sender | mailer-example.test | No |
| DKIM signing domain | mailer-example.test | No |

- [Read the alignment guide](https://checkdmarc.mx/learn/dmarc#alignment)

## Ask the sending platform for domain authentication

Open the domain-authentication settings in the service that sent the newsletter. Look for custom-domain DKIM and, where supported, a custom return-path or bounce domain. Follow that provider’s exact DNS instructions for your account.

Adding the provider to an unrelated SPF record will not change the message’s signing domain. Changing DMARC to p=none also does not make a failing message pass; it changes the requested treatment of failures.

- [Investigate the SPF identity](https://checkdmarc.mx/learn/spf)
- [Check the DKIM signing domain](https://checkdmarc.mx/learn/dkim)

## Confirm the change on a fresh message

After the provider confirms the setup and DNS caches have had time to refresh, send a new newsletter test through that same platform. Compare the reported identities with your earlier result. Record what changed, rather than relying on the provider’s setup screen alone.

Repeat this for other sending services. An invoice tool, a website form and your mailbox can each need their own configuration.

- [Create a fresh test address](https://checkdmarc.mx/#email-check)
- [See an aligned passing example](https://checkdmarc.mx/sample-result)

## Sources

- [RFC 9989 §4.4 — identifier alignment](https://www.rfc-editor.org/rfc/rfc9989.html#section-4.4)

## Related reading

- [DMARC: connect authentication to your From domain](https://checkdmarc.mx/learn/dmarc/index.md)

- [DKIM: understand the signature on your email](https://checkdmarc.mx/learn/dkim/index.md)

- [An email authentication checklist for every sending service](https://checkdmarc.mx/blog/email-authentication-checklist/index.md)

[Check your email](https://checkdmarc.mx/#email-check)

Web page: https://checkdmarc.mx/blog/spf-dkim-pass-dmarc-fail