← All guides

Why DKIM Shows "Signature Valid" But DMARC Still Fails

You checked your headers, and DKIM says pass. The cryptographic signature is valid. So why does DMARC — which is supposed to rely on DKIM — still report a fail, and why is your church or ministry's mail still landing in spam or getting rejected outright? The short answer: DMARC doesn't just check whether DKIM is valid. It checks whether the domain that signed the message with DKIM matches (or "aligns with") the domain in the visible From address. A signature can be perfectly valid and still fail DMARC if it was signed by the wrong domain. This is one of the most common — and most misunderstood — reasons legitimate church email ends up flagged as suspicious by Gmail and Outlook.

DKIM validity and DMARC alignment are two different checks

DKIM authentication actually asks two separate questions, and it's easy to conflate them.

First: is the signature cryptographically valid? This means the message wasn't altered in transit and the signature matches the public key published in DNS at the signing domain's `_domainkey` record. When your mail headers show "dkim=pass," this first check succeeded.

Second, and separately: does the domain that signed the message (the `d=` value in the DKIM-Signature header) match the domain in your visible From address? This is DKIM alignment, and it's DMARC's job to check it — not DKIM's. DKIM itself doesn't care about alignment at all; it only cares whether the signature is authentic. DMARC adds the alignment requirement on top.

So you can absolutely have `dkim=pass` and `dmarc=fail` on the same message. The signature was real. It just wasn't signed by a domain DMARC considers "you."

The most common cause: a third-party sending domain

The single most frequent reason we see this at churches and small ministries is a giving platform, newsletter tool, or church management system (Planning Center, Mailchimp, Tithe.ly, Constant Contact, etc.) sending mail that looks like it's from your organization but is DKIM-signed by the vendor's own domain.

For example, your donation receipt shows `From: giving@yourchurch.org`, which is what your members see. But if the DKIM signature underneath was applied by the vendor and reads `d=sendgrid.net` or `d=mailchimp.com` instead of `d=yourchurch.org`, that's a mismatch. DKIM still validates fine (the vendor's signature is genuine), but DMARC alignment fails because the signing domain doesn't match — or doesn't share the same organizational domain as — the visible From address.

The fix is almost always vendor-side: ask the platform to set up "custom DKIM" or "domain authentication" so it signs outgoing mail with your own domain instead of its own. Most major platforms support this; it typically means adding a CNAME or TXT record they provide.

Strict vs. relaxed alignment — the subdomain trap

DMARC has two alignment modes, set by the `adkim` tag in your DMARC record. Relaxed alignment (`adkim=r`, the default if you don't specify it) allows the signing domain and the From domain to match at the organizational level — so `mail.yourchurch.org` signing for `yourchurch.org` still aligns. Strict alignment (`adkim=s`) requires an exact match, so `mail.yourchurch.org` signing for `yourchurch.org` would fail.

This trips up organizations that send from a subdomain (a common setup for bulk mail, like `newsletter.yourchurch.org`) while their DMARC record specifies strict mode. If you're not intentionally trying to lock things down, relaxed alignment is the safer default and is what we recommend for nearly every church or small nonprofit.

Check your current setting by looking up your TXT record at `_dmarc.yourdomain.org`. If you see `adkim=s`, that's worth revisiting unless every sending source uses your exact root domain.

Multiple DKIM signatures: only one has to align

A message can carry more than one DKIM signature — for example, if it passes through a forwarding service or an email security gateway that adds its own signature on top of your original one. DMARC only needs ONE aligned, passing signature to consider DKIM authentication successful for that mechanism.

The confusion happens when someone reads the headers and sees a passing DKIM signature, assumes that's the one that matters, but it's actually a signature added by an intermediary system using ITS domain — while your organization's own signature further down either failed or was stripped in transit. Read the `d=` value on every DKIM-Signature header in the message, not just the first one you find, to see which one DMARC actually evaluated.

How to check alignment yourself, step by step

1. Send a test email from your church's account to a Gmail address you control (a personal Gmail account works fine for this).
2. Open the received message in Gmail, click the three-dot menu, and choose "Show original."
3. Find the Authentication-Results header near the top. It will show three separate results: spf=pass/fail, dkim=pass/fail, and dmarc=pass/fail, each with details in parentheses.
4. Look specifically at the DKIM line for the `header.d=` value — this is the domain that actually signed the message. Compare it to the domain after the @ in your From address.
5. If DKIM shows pass but lists a different `header.d=` domain than your From address, and DMARC shows fail with `dkim=fail` in its own explanation (not the earlier DKIM line), that mismatch is your answer. Note that Gmail's summary line can show `dkim=pass` for the raw signature check while the `dmarc=` result on the same header block correctly shows fail — read both lines carefully, they're not describing the same test.

SPF alignment can rescue you (and why that's not a real fix)

DMARC passes if EITHER SPF or DKIM aligns — it doesn't require both. So if your SPF record aligns correctly even while DKIM doesn't, your mail may still pass DMARC overall. This is why some organizations see "DMARC: pass" in their aggregate reports even with a known DKIM alignment problem, and assume everything is fine.

Don't treat this as a fix. Relying on SPF alone leaves you exposed the moment that sending source changes IPs, gets forwarded (SPF famously breaks on forwarding, DKIM doesn't), or a new vendor gets added without updating your SPF record. Fixing DKIM alignment properly, on every sending source, is what makes your authentication resilient rather than accidentally passing.

Fixing it for good

For each system that sends mail as your domain — your primary mailbox provider, your giving platform, your email newsletter tool, your church management software — confirm it's DKIM-signing with your domain, not its own. Most providers call this "custom DKIM," "domain authentication," or "branded links & domains," and setup is a DNS record or two, usually a CNAME pair they generate for you.

Once every sender aligns, start your DMARC policy at `p=none` and watch the aggregate reports (sent to an address you specify in the DMARC record) for a week or two to confirm every legitimate source is passing before moving to `p=quarantine` and eventually `p=reject`. Jumping straight to `p=reject` before every sending source aligns is the single most common way churches accidentally block their own donation receipts and newsletters.

Check my church's email — free →

Frequently asked questions

Can DKIM pass and DMARC fail on the same email?

Yes, and it's common. DKIM checks whether a signature is cryptographically valid; DMARC additionally requires that the signing domain align with your visible From address. A message can have a genuine, valid DKIM signature from a domain that simply isn't yours (or isn't close enough to yours), which passes DKIM but fails DMARC alignment.

What is DKIM alignment in DMARC?

DKIM alignment is DMARC's requirement that the domain in the DKIM signature's `d=` tag match the domain in the visible From address, either exactly (strict mode) or at the organizational level (relaxed mode, the more common default). It's a separate check from whether the DKIM signature itself is valid.

Why does my giving platform's email fail DMARC even though it's legitimate?

Most giving and email marketing platforms sign outgoing mail with their own domain by default, not yours. Unless you set up custom DKIM (sometimes called domain authentication) with that vendor, your messages will show a valid DKIM signature from their domain, which doesn't align with your From address and fails DMARC.

Does DMARC require both SPF and DKIM to pass?

No. DMARC passes if either SPF or DKIM aligns successfully — you don't need both. This means a DKIM alignment problem can sometimes be masked by a passing, aligned SPF record, which is worth fixing properly rather than relying on as a permanent workaround.

How do I fix a DKIM alignment failure?

Identify every system sending mail on behalf of your domain, then enable custom/branded DKIM signing with each one so they sign using your domain instead of their own. This usually means adding a CNAME or TXT record the vendor provides. Confirm with a test send and header check before tightening your DMARC policy.