iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
SPF and DKIM can both report “pass” without proving that an email came from the domain shown in its visible From address. DMARC makes that connection: it passes only when SPF or DKIM passes and the authenticated domain aligns with the visible From domain. If neither passing result aligns, the message can fail DMARC despite valid underlying checks.
What SPF, DKIM, and DMARC each check
Email authentication involves several identities, and they are not necessarily the same. The key is to compare the domain each check actually authenticates with the domain the recipient sees.
- Visible From: The domain in the message’s RFC5322.From header, such as
example.cominFrom: invoices@example.com. - SPF: Checks whether a sending host is authorized for the SMTP HELO or MAIL FROM identity. The MAIL FROM domain is commonly reflected in the message’s return-path or bounce address; it may differ from the visible From domain. RFC 7208 describes SPF as covering the HELO and MAIL FROM identities: RFC 7208.
- DKIM: Verifies a cryptographic signature associated with a signing domain. That domain is shown in the signature’s
d=value, and it may not match the visible From domain. See the DMARC specification’s treatment of authenticated identifiers and alignment: RFC 7489. - DMARC: Compares the visible From domain with the domain authenticated by SPF or DKIM. A passing SPF result or valid DKIM signature alone is not enough if its domain does not align.
How valid SPF and DKIM results can still fail DMARC
Suppose a message says From: invoices@example.com, but SPF passes for bounce.vendor.net and a valid DKIM signature uses d=vendor.net. Both checks can be technically valid: the sender is authorized to send for the bounce domain, and the signature verifies for the signing domain. Yet neither result authenticates example.com for DMARC, so DMARC can fail.
Recommended Free Tools
This example is illustrative. A mail provider may instead configure a custom return-path or DKIM signing domain that aligns with the customer’s domain. In that case, a passing SPF or DKIM result can also satisfy DMARC.
#1 Best Overall
- POWERFUL SECURITY KEY: The YubiKey 5 NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
What alignment means
DMARC alignment is the relationship between the visible From domain and the SPF-authenticated MAIL FROM domain or DKIM signing domain. Alignment is assessed separately for SPF and DKIM, and either mechanism can satisfy DMARC if it both passes and aligns.
- Relaxed alignment: Allows the authenticated domain and visible From domain to match at the organizational-domain level, even when their full domain names differ.
- Strict alignment: Requires the domain names to match exactly.
For example, whether mail.example.com aligns with example.com depends on whether relaxed or strict alignment applies to that mechanism. A green “SPF pass” or “DKIM pass” label does not show whether alignment succeeded. RFC 7489 explains why: “Identifier Alignment is required because a message can bear a valid signature from any domain, including domains used by a mailing list or even a bad actor.”
Rank #2
- Security Key : Protect your online accounts against unauthorized access by using FIDO2 and U2F authentication with T110. It's the world's most protective security key that works with windows, Mac OS, Linux as well as Chrome, Firefox, Edge and many other major browsers.
- Certified with the new FIDO2 standard, T110 provides the benefit of fast login and strong protection against phishing, account takeover as well as many other online attactks.
- Works with : Bank of America, Github, Google, Microsoft, DUO, Twitter, Facebook, Dropbox, Apple, ebay, BINANCE, mor and more.
- Fits USB-A port : Insert the T110 security key into the USB-A port of each service and log in conveniently with one touch
- For the driver download and user guide, please visit TrustKey Solutions Home support page.
How to diagnose a message that looks spoofed
- Find the visible From domain. Read the domain in the message’s RFC5322.From header, not just the display name.
- Check the SPF identity. In the authentication results, identify the domain SPF evaluated—normally the SMTP MAIL FROM domain—and note whether SPF passed.
- Check each DKIM signature. Find the
d=domain for every validating signature. A message can have multiple signatures, so check each one rather than assuming there is only one. - Compare the domains for alignment. Determine whether a passing SPF identity or a passing DKIM signing domain aligns with the visible From domain under the applicable strict or relaxed setting.
- Inspect the effective DMARC policy. Check the DMARC record for the From domain and account for any applicable subdomain policy. Then distinguish the policy requested by the domain owner from the receiver’s actual handling.
The deciding question is not simply “Did SPF or DKIM pass?” It is “Did at least one passing mechanism authenticate a domain aligned with the visible From domain?”
The Tool Desk
Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →What a DMARC policy does—and does not—guarantee
A DMARC policy tells receivers what action the domain owner requests for messages that fail DMARC. p=none requests no specific action on failures; p=quarantine and p=reject request stronger dispositions. These are receiver-applied policies, not sender-side firewalls or universal guarantees.
Rank #3
- A FIDO security key with PUF technology provides a unique, hardware-rooted trust anchor that resists tampering and cyber attacks, offering stronger security than conventional designs.
- FIDO2 Certified Protection – Enjoy phishing-resistant security with FIDO2 certification, ensuring top-tier account safety across Windows, macOS, Linux, iOS iOS, Android and more.
- Easy to use & Portable – Designed with a compact USB-C interface, Clife key fits easily on your keychain for secure access anywhere. Simply plug in and authenticate with ease.
- Universal Compatibility – Works seamlessly with hundreds of FIDO2/U2F compliant services, including popular cloud, email, and social platforms.
- Backup recommended – To ensure continuous access, register a backup Clife security key as a spare in case your primary key is lost.
RFC 7489 says receivers should make a best-effort attempt to follow the requested policy, but may deviate during processing and report the reason. As a result, receivers can handle the same DMARC failure differently, including in complex mail flows. A published reject policy is meaningful protection, but it does not guarantee that every receiver will reject every failing message.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Why a domain can still appear in a spoofed message
Publishing SPF, DKIM, and DMARC records does not prevent someone from writing your domain in a visible From header. Instead, DMARC gives receivers a way to evaluate whether the message’s passing SPF or DKIM identity aligns with that From domain, and a policy communicates how failures should be handled. If the message uses unrelated domains for its valid SPF and DKIM checks, it can still fail DMARC even though both checks pass individually.
Rank #4
- POWERFUL SECURITY KEY: The YubiKey 5C NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5C NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5C NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
The RFC Editor’s search result identifies RFC 9989 as the current DMARC specification. The detailed alignment and receiver-behavior explanations here refer to RFC 7489; this article does not characterize changes between those specifications.
Free tools Windows power users keep installed
One-click scans. No signup required.
Quick Recap
Best Value
- Ultra-Compact FIDO2 Security Key - Plug-and-stay or carry on a keychain. This USB-A hardware security key offers portable, always-on protection for desktop and mobile use. (Item Size: 0.75 X 0.74 IN x 0.25 IN)
- USB-A Hardware Key for All Devices - Works with USB-A ports on PC, Mac, Android, and other laptop/notebook device. Enables secure, cross-platform login with FIDO2.0 passkey support.
- FIDO Certified Security Key - Meets FIDO and FIDO2 standards. Works with Google, Microsoft, GitHub, Dropbox, and more. Please check service compatibility before purchase.
- Passwordless Login with Passkey - Supports passkey login via WebAuthn and CTAP2. Enjoy password-free sign-ins where supported. Not all websites or services currently support passkeys.
- Advanced Multi-Factor Authentication - Offers 200 FIDO2 passkey slots and 50 OATH-TOTP slots. Strong, flexible 2FA/MFA support across various apps and authentication platforms.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
