Where you saw it: An aggregate report where the SPF or DKIM column says pass and the corresponding alignment column says fail.
Why it happens
- The envelope sender belongs to your sending platform. SPF passes for bounces.platform.com while your From header says yourcompany.com, and those do not align.
- DKIM is signing with the platform's domain in the d= field rather than yours, so the signature is valid and aligned with them.
- Your DMARC record sets aspf=s or adkim=s, which requires an exact domain match and rejects the subdomain relationship that relaxed mode allows.
- Mail is sent from a subdomain while the DMARC policy sits on the root with strict alignment.
The fix, in order
Work out which mechanism is close to aligning
Read the aggregate report rows for that source. If DKIM passes with the platform's domain, fixing DKIM alignment is usually a single setting. If SPF passes on a platform bounce domain, you need a custom return path.
Set a custom return path for SPF alignment
Most platforms offer this as a CNAME you publish on a subdomain of your own. Once the envelope sender is bounces.yourcompany.com, SPF passes and aligns in relaxed mode.
Sign DKIM with your own domain
In the platform's DKIM setup, publish the key on your domain so the d= field reads yourcompany.com. This is usually the easier of the two fixes and it survives forwarding.
Use relaxed alignment unless you have a reason not to
Relaxed mode accepts any subdomain of the organizational domain, which covers almost every real setup. Strict mode is for organizations that have mapped every sender and want no flexibility at all.
How to know it worked
The short version
- The alignment column in your aggregate reports reads pass for that source.
- Authentication-Results shows dmarc=pass on a test message.
- Check both mechanisms. One aligning is enough for DMARC and two is far more durable.
Questions people ask
What does relaxed alignment actually allow?
Any subdomain of the same organizational domain. With relaxed alignment, mail.yourcompany.com aligns with yourcompany.com. With strict alignment it does not.
Which is better to align, SPF or DKIM?
DKIM, because it survives forwarding. SPF breaks whenever a message is relayed. Align both if you can, and prioritize DKIM if you can only do one.
Why does my platform's DKIM not count?
Because the signature is valid for their domain, not yours. DMARC asks whether the authenticated domain matches the one your recipient sees, and their domain does not.