Why does alignment sometimes fail even if SPF/DKIM passes?

Authentication is not the same as alignment.

A third party sender such as a marketing platform might send a message that passes SPF for sendingserver.com and passes DKIM for click.esp domain.net while the visible From domain is yourbrand.com.

Both SPF and DKIM passed but since yourbrand.com matches neither authenticated domain DMARC fails.

Was this answer helpful?

Thanks for your feedback!