Level: Intermediate
DKIM can technically pass while still failing DMARC alignment, a subtle but common failure mode that trips up many senders relying on third-party email service providers.
Signing Domain Mismatch Is the Most Common Cause
When an email service provider signs DKIM using its own domain rather than your sending domain, the DKIM check itself can pass while DMARC alignment fails, since alignment requires the signing domain to match the From domain.
Custom DKIM Setup Resolves This for Most ESPs
Most reputable email service providers offer a custom DKIM signing option that uses your own domain and a selector they control, resolving the alignment mismatch.
Body or Header Modification in Transit Can Invalidate Signatures
Any system that modifies message content after DKIM signing, like certain forwarding or relay configurations, can break the cryptographic signature and cause DKIM to fail entirely.
Next step: Use the Find DNS Records to check whether your DKIM record's signing domain actually matches your sending domain to catch this common alignment issue.