# DMARC: dmarc=fail (p=REJECT) — SPF and DKIM pass but domains are not aligned with the From header

**Code:** `DMARC fail: SPF and DKIM not aligned` · **Category:** Email / SMTP · **Seen on:** SMTP

Authentication passed for another domain (your ESP's), but neither the SPF Return-Path domain nor the DKIM `d=` domain matches the visible From domain, so DMARC fails.

## Meaning

DMARC needs at least one of SPF or DKIM to pass AND align with the From: domain. Using a third-party sender without custom domain authentication signs with the provider's domain. Configure custom DKIM (and a custom Return-Path/bounce domain) at the provider so `d=` equals your domain.

## Common causes

- ESP signing with its own domain (d=sendgrid.net)
- Return-Path domain differs from From
- Relaxed vs strict alignment setting (adkim/aspf=s)
- Subdomain From with parent-only keys
- Forwarding breaking SPF and no DKIM

## Quick fix

1. Enable custom domain authentication (DKIM CNAMEs) at the ESP
2. Set a custom return-path/bounce domain
3. Check `adkim`/`aspf` (use relaxed `r` unless needed)

## Detailed fix by platform

### Linux

1. Read the headers `Authentication-Results:` for `header.i=` (DKIM d=) and `smtp.mailfrom=`; compare both with `header.from=`

## How to diagnose

1. **From** — Visible From domain?
2. **DKIM d=** — Same organizational domain?
3. **Return-Path** — Same domain?

---
Source: [WhatIsMyError](https://whatismyerror.com/errors/email/dmarc-alignment-failure)