DIAGNOSTIC PLAYBOOK
SPF passes but DMARC fails: inspect the return-path domain
SPF can pass for a vendor-controlled return-path domain without aligning with your visible From domain. DMARC needs an aligned pass, not simply the word pass anywhere in the authentication results.
HealthCheck Email editorial team · · Examples are illustrative
How to investigate
- Record the visible From domain and the exact smtp.mailfrom domain that passed SPF.
- Check whether the two domains align under the published policy.
- Inspect DKIM as well, then configure a supported custom return path or aligned signing at the sending service.
What this looks like
ILLUSTRATIVE EXAMPLE
The message is From billing@example.com but SPF passes for bounce.vendor.example. That successful vendor authorization does not establish alignment with example.com.
A mistake to avoid
Adding the vendor's include to your root SPF may not fix alignment when the message never uses your root domain as its envelope identity.
Keep the result in context
DMARC connects the visible From domain to a passing, aligned SPF or DKIM identity. A DNS policy is an instruction to receivers, not a delivery receipt. Use message results and aggregate reports together, and identify legitimate services before tightening a policy.
Take the next step
Use the related check to gather evidence, then compare it with the affected message or service. Keep the result and time with your notes so a later change can be distinguished from the original problem.
Sources and further reading
The protocol references below explain the underlying behavior. Your sending or DNS provider supplies the account-specific settings for its service.