# SPF, DKIM, DMARC alignment > Understand what SPF, DKIM and DMARC each check, why a record can pass and DMARC still fail, and how to reach aligned authentication with Broadcast. Source: https://sendbroadcast.net/university/deliverability/spf-dkim-dmarc-alignment Most senders know they need SPF, DKIM and DMARC. Fewer know why all three can be "set up" and mail still fails. The answer is **alignment**. In this lesson you learn what each record checks, how DMARC ties them to your From address, and how to reach a setup that passes for the right reason. ## Three checks, three different domains An email carries more than one domain, and each check looks at a different one. 1. **The From domain** is what the reader sees, such as `news@example.com`. DMARC protects this one. 2. **The envelope sender**, also called the Return-Path or bounce domain, is where bounces go. Readers never see it. **SPF** checks this domain: is the sending server listed in its SPF record? 3. **The DKIM signing domain** is the `d=` value in the DKIM signature. **DKIM** checks that the signature is valid for this domain. Here is the catch. When you send through a provider, the envelope sender and the DKIM domain can both belong to the **provider**, not to you. SPF passes, DKIM passes, and yet neither says anything about `example.com`. ### From `news@example.com` - The reader sees this - DMARC protects it ### Envelope sender Belongs to the provider - Readers never see it - SPF checks it ### DKIM `d=` Belongs to the provider - In the signature - DKIM checks it One email through a provider, with no alignment set up. Three domains, and only one is yours. ## What alignment means **DMARC** closes that gap. A message passes DMARC when at least one of these is true: - SPF passes, and the envelope sender domain **aligns** with the From domain. - DKIM passes, and the `d=` domain **aligns** with the From domain. Aligned means the same domain. In **relaxed** mode, which is the default, the same organizational domain is enough: a signature from `mail.example.com` aligns with a From of `example.com`. In **strict** mode the names must match exactly. Start relaxed. So a pass for the provider's domain is not enough. You need a pass for **your** domain. ### DMARC fails - SPF passes for the provider's domain - DKIM passes for the provider's domain - Neither aligns with `example.com` ### DMARC passes - SPF passes for the provider's domain - DKIM passes with `d=mail.example.com` - One aligned pass is enough Both emails pass SPF and DKIM. Only one passes DMARC. The From domain is `example.com`. ## How to get DKIM aligned DKIM alignment is the one to get right first, because it survives forwarding better than SPF does. 1. Verify your sending domain at your provider, not only a single address. 2. Publish the DKIM records the provider gives you. Amazon SES gives you three CNAMEs. Postmark and others give you one record with a selector. 3. Check that the provider now signs with `d=` set to your domain. Send yourself a test and look at the headers, or check the DMARC reports. When you use Guided Setup in Broadcast, the wizard reads the domains your provider has verified. For a domain to count as verified for a sender identity, Broadcast needs the provider to report **both** DKIM and SPF as verified. ## How to get SPF aligned For SPF to align, the envelope sender must be on your domain. Providers call this a **custom Return-Path** or **custom MAIL FROM**. You set a subdomain, such as `bounce.example.com`, at the provider and publish the records it gives you there. Remember the SPF rules while you do this. A domain has **one** SPF record. If you send through two services, merge them into a single record. Two SPF records is a failure, not a backup. SPF also allows at most 10 DNS lookups, so a record with many `include:` entries can break without warning. ## How Broadcast shows this Open **Settings → Email → Domain DNS Health**. Each sending domain has a row for SPF, DKIM and DMARC. With a custom Return-Path, SPF is checked at the bounce domain, not your From domain. So when your provider has verified the domain, Broadcast shows SPF as **Covered by provider** instead of a red **Missing**. The same goes for DKIM when the provider uses random selector names that Broadcast cannot guess. DKIM present is not the same as DKIM aligned. If DKIM shows **Healthy** but DMARC reports still show failures, check the `d=` domain. The [DKIM alignment guide](/dkim-signature-alignment) walks through it. ## Roll out DMARC in steps A DMARC record lives at `_dmarc.example.com`. When a domain has none, Broadcast suggests one: ``` v=DMARC1; p=none; rua=mailto:dmarc-reports@example.com ``` The `p=` value is the policy for mail that fails: 1. **`p=none`**: deliver it, but send reports. Start here. 2. **`p=quarantine`**: put failing mail in spam. 3. **`p=reject`**: refuse failing mail. The `rua=` address receives daily aggregate reports from receivers. Read them for a few weeks. They list every service that sends as your domain, including ones you forgot, such as a help desk or a billing tool. Fix each one, then move to `quarantine`, then to `reject`. 1. **`p=none`** Deliver it and send reports 2. **`p=quarantine`** Put failing mail in spam 3. **`p=reject`** Refuse failing mail. This is the goal One step at a time, and move on only when the reports are clean. Warning Never start at `p=reject` on a domain you have not observed. A forgotten service that sends your invoices would have its mail refused. One record covers subdomains. If you send from `news.example.com` and there is no record at `_dmarc.news.example.com`, receivers use the record at `example.com`. Broadcast reads it the same way and shows the inherited policy. Do not add copies per subdomain: they can drift from your main policy. ![A DNS Health card for send.example.com with DMARC Healthy and a note that the record is inherited from example.com](https://sendbroadcast.net/assets/docs/dns-health/dns-health-dmarc-inherited-73a9e8e0.png) Read the DMARC row: the record is inherited, so no extra record is needed. The SPF and DKIM rows are separate checks on this test domain. ## When a record breaks later DNS changes. A registrar move or a colleague editing SPF can break alignment months after you set it up. Broadcast checks every 6 hours and raises an alert after 2 failed checks in a row. If you changed a record on purpose, click **Reset baseline**. See [fix DNS authentication](/how-to/fix-dns-authentication). ## What you learned - SPF checks the envelope sender, DKIM checks the `d=` domain, DMARC protects the From domain. - DMARC passes when SPF or DKIM passes for a domain that aligns with the From domain. - Align DKIM by verifying your domain, and SPF with a custom Return-Path. - Roll DMARC out from `p=none` to `quarantine` to `reject`, guided by the reports. ## Quiz 1. When does a message pass DMARC? - When SPF and DKIM both pass, aligned or not - When SPF or DKIM passes and its domain aligns with the From domain (correct) - When the domain has any DMARC record DMARC needs at least one of SPF or DKIM to pass for a domain that aligns with the visible From domain. 2. Which domain does SPF check? - The envelope sender (Return-Path) domain (correct) - The From domain only - The domain in the DKIM signature - The link domain in the email body SPF checks the envelope sender, also called the Return-Path or bounce domain, which is often your provider's domain unless you set a custom one. 3. Why does Domain DNS Health sometimes show SPF as Covered by provider? - Broadcast skips SPF checks for paid providers - The SPF record is invalid but ignored - The provider verified the domain, and with a custom Return-Path SPF is checked at the bounce domain (correct) With a custom Return-Path, SPF is checked against the bounce domain, so a missing SPF record at the From domain is not a problem.