Why does SPF alignment show as 0% on Validity, even when SPF passes?
Updated on 31 Jul 2026: We updated this guide for RFC 9989 and clarified how report scope, rounding, forwarding, and null reverse paths affect SPF alignment.
SPF alignment can show as 0% on Validity even when SPF passes because those are different checks. SPF passing means the sending IP was authorised by the domain used in the SMTP envelope sender. SPF alignment means that same envelope sender domain also matches, or shares the same organisational domain as, the visible From domain.
That means 100% SPF pass and 0% SPF alignment is possible. It usually means your email service provider is using its own bounce or return-path domain, while your visible From address uses your brand domain. Validity is then reporting a real DMARC alignment outcome, not saying SPF authentication failed.
The practical question is whether DKIM is aligned. DMARC only needs one path to pass: SPF must pass and be aligned, or DKIM must pass and be aligned. If aligned DKIM is carrying DMARC, 0% SPF alignment can be acceptable. If DKIM is not aligned either, DMARC fails.
The short answer
A 0% SPF alignment result points to the envelope domain first. It does not prove that SPF is broken. Check the Return-Path, also called the bounce domain, because that is usually the domain SPF evaluates. Then compare it with the header From domain that the recipient sees.
- SPF pass: The sending IP is authorised for the envelope sender domain.
- SPF alignment: The envelope sender domain matches the visible From domain under DMARC rules.
- DMARC pass: Either SPF or DKIM passes and has domain alignment with the visible From domain.
- Validity 0%: No aligned SPF was counted in the selected scope, or the aligned share rounded to 0%.
Read all results together
Do not judge the source by SPF pass alone. Read SPF pass, SPF alignment, DKIM pass, DKIM alignment, and DMARC disposition together. A domain can have clean SPF authentication and still have no SPF alignment at all.
- Expected state: SPF passes on the vendor domain, DKIM passes on your domain, and DMARC passes through DKIM.
- Risky state: SPF passes on the vendor domain, DKIM uses a vendor domain, and DMARC fails.
Why SPF can pass without SPF alignment
SPF does not check the domain in the visible From header. It checks the SMTP envelope sender, usually exposed in message headers as Return-Path or smtp.mailfrom. If a bounce message has a null reverse path, SPF uses the HELO or EHLO domain as its authenticated identifier instead.
Flowchart showing SPF passing on the envelope domain before DMARC checks alignment.
In relaxed alignment, the authenticated domain and visible From domain have the same organisational domain. A bounce domain like bounce.example.com commonly aligns with example.com. In strict alignment, the domains must match exactly. Relaxed SPF alignment is the default unless the DMARC record says aspf=s.
|
|
|
|---|---|---|
SPF pass | Sender IP | Not enough |
SPF aligned | Envelope domain | Can pass |
DKIM aligned | Signing domain | Can pass |
DMARC pass | One aligned path | Passes |
How SPF pass, SPF alignment, DKIM alignment, and DMARC relate.
Keep SPF authentication and alignment separate when diagnosing reports. The names sound similar, but they answer different questions.
What RFC 9989 changes
RFC 9989 is the current Standards Track DMARC specification and obsoletes RFC 7489 and RFC 9091. The core result is unchanged: SPF must pass with an aligned authenticated identifier, or DKIM must pass with an aligned signing domain. The updates matter when a report parser determines the organisational domain or labels a field as authentication versus alignment.
- Relaxed alignment: Receivers now use a bounded DNS Tree Walk to determine organisational domains instead of relying on the Public Suffix List method in RFC 7489.
- Strict alignment: Exact domain equality still decides the result, so the tree-walk change does not affect a strict match.
- DMARC tags: The pct tag is historic. RFC 9989 adds the t testing tag, while aspf and adkim still default to relaxed alignment.
- Aggregate data: RFC 9990 separates policy-evaluated SPF and DKIM alignment fields from raw SPF and DKIM results in auth_results.
What this means for a 0% result
Do not change a return-path only because the standard changed. A legacy receiver and a current receiver can disagree at unusual subdomain boundaries during the transition, but a vendor-owned envelope domain and an unrelated brand From domain remain unaligned. Confirm the underlying authenticated domain and the receiver's evaluated alignment result.
Why Validity can show 0 percent
A 0 percent SPF alignment view in Validity is common when a domain sends through platforms that authenticate SPF with their own return-path domain unless a custom bounce domain has been configured. This often appears in marketing automation and transactional sending setups where the visible From domain has been branded but the envelope sender remains under the provider.
Validity Everest-style authentication report showing SPF pass at 100% and SPF alignment at 0%.
Check report scope before treating 0% as an exact statement about every message. Aggregate records group messages by source IP and evaluated outcome, while a product screen can roll several records into one source or time range. A small aligned share can also round to 0%. Inspect the underlying records or raw headers when a summary appears to show alignment passing alongside DMARC failures.
Concrete examples include Mailchimp, Constant Contact, SendGrid, Amazon SES, Iterable, SparkPost, and ActiveCampaign. Each can produce different results depending on whether custom return-path, bounce domain, and DKIM signing have been configured. The brand name alone does not prove the result; the header does.
Forwarding creates another pattern. If the forwarder changes the sending IP, SPF often fails. If it uses Sender Rewriting Scheme (SRS), SPF can pass for the forwarder's domain but remain unaligned with the original From domain. DKIM can still carry DMARC when the signed content survives unchanged. ARC can explain a receiver policy override, but it does not turn an unaligned SPF identity into an aligned one.
What Validity is likely showing
- SPF pass: The vendor return-path domain authorised the sending IP.
- Alignment 0%: The return-path domain is not your organisational domain.
- DMARC pass: Aligned DKIM is probably doing the DMARC work.
What to verify before fixing
- Envelope domain: Check the Return-Path or smtp.mailfrom value.
- DKIM domain: Check whether the d= value matches your From domain.
- Report scope: Confirm the view is not filtered to one unaligned stream.
How to confirm the cause
The fastest check is to send a real message through the same source and inspect the raw headers. Capture the unmodified Authentication-Results header, plus Return-Path and From. If the message has gone through forwarding or security rewriting, use a fresh mailbox that receives the original message directly.
Header pattern that explains 0% SPF alignmenttext
Return-Path: <bounce@esp-mail.example.net> From: Brand <news@example.com> Authentication-Results: mx.receiver.example; spf=pass smtp.mailfrom=esp-mail.example.net; dkim=pass header.d=example.com; dmarc=pass header.from=example.com
In that example, SPF passes for esp-mail.example.net, but the visible From domain is example.com. SPF is authenticated, but SPF is not aligned. DMARC still passes because DKIM uses example.com as the signing domain.
- Check From: Record the domain after the visible From address.
- Check envelope: Record the domain in Return-Path or smtp.mailfrom. If it is empty, record the HELO or EHLO domain.
- Check DKIM: Record the domain in the DKIM d= value.
- Check DMARC: Pair each authentication result with its alignment result to identify the path that satisfies DMARC.
Before changing DNS, validate the policy itself with a DMARC checker. If you need a broader read across SPF, DKIM, and DMARC, run a domain health checker before you edit vendor settings.
?
What's your domain score?
Deep-scan SPF, DKIM & DMARC records for email deliverability and security issues.
How to fix SPF alignment
Fixing this means making the envelope sender domain line up with the visible From domain, or deciding that DKIM alignment is the better path for that source. Start in the sending platform before changing SPF because most alignment failures come from an unbranded bounce domain, not a missing IP in the From domain's SPF record.
Do not flatten this into a basic SPF edit
Adding more includes to your SPF record does not make SPF aligned if the envelope sender domain is still owned by the vendor. It can also push you toward the SPF DNS lookup limit. The bounce domain needs the right branding and DNS delegation.
- Configure bounce: Set a custom return-path or bounce domain in the sending platform.
- Publish DNS: Add the CNAME, MX, or TXT records the sender gives you.
- Keep DKIM: Use a signing domain under your organisational domain.
- Retest mail: Send fresh messages and inspect headers after DNS has propagated.
- Watch reports: Wait for DMARC aggregate reports to show the new source behaviour.
Current DMARC record while validating alignmenttext
v=DMARC1; p=none; rua=mailto:dmarc@example.com; aspf=r; adkim=r
Suped's DMARC monitoring product can group report data by sending source, show where SPF passes without alignment, and confirm whether aligned DKIM is carrying DMARC. After a custom return-path change, use the same source view to check when aggregate reports begin showing the new envelope domain. See DMARC monitoring for that workflow.
Issue steps to fix dialog showing the issue overview, tailored fix steps, and verification action
For teams managing policy changes across many domains, Suped's Hosted DMARC product can stage policy changes without repeated manual DNS edits. Keep the sender's custom return-path work separate from enforcement changes so each result is easy to verify.
When 0 percent SPF alignment is acceptable
A 0 percent SPF alignment number is not automatically a deliverability problem. It is acceptable when DKIM is consistently aligned, DMARC is passing, and the source is intentionally configured to rely on DKIM alignment. It deserves action when DKIM alignment is missing, when DMARC failures appear for the same source, or when the sender requires SPF alignment for a compliance reason.
How to read SPF alignment percentages
These values describe the selected traffic. They are not universal deliverability scores.
All reported mail aligned
100%
The custom return-path probably covers the selected traffic.
Mixed alignment
>0% and <100%
The selected traffic contains different envelope domains or sender configurations.
No reported alignment
0%
Verify aligned DKIM, the selected scope, and display rounding before deciding on a fix.
If the sending source is Iterable using SparkPost for dedicated IPs, the same logic applies. The dedicated IP can be authorised for SPF under a SparkPost or vendor-managed envelope domain. That gives you SPF pass. It does not give you SPF alignment unless the return-path domain has your organisational domain.
|
|
|
|---|---|---|
 Mailchimp | Vendor bounce | SPF unaligned |
 SendGrid | Unbranded | SPF unaligned |
 Amazon SES | Default MAIL FROM | SPF unaligned |
 ActiveCampaign | Custom option | Can be aligned |
Typical sender outcomes when bounce branding varies.
Views from the trenches
Best practices
Inspect raw headers before changing DNS; the envelope domain explains most SPF alignment gaps.
Treat SPF pass and SPF alignment as separate results when reviewing DMARC report data.
Verify aligned DKIM for each sender before accepting 0% SPF alignment as harmless.
Common pitfalls
Adding SPF includes to the From domain does not fix alignment when MAIL FROM differs.
Assuming DMARC needs both SPF and DKIM aligned leads to the wrong remediation plan.
Reading a filtered report view as whole-domain truth can hide mixed sender behaviour.
Expert tips
Ask vendors for custom return-path support, not only sender IP ranges or SPF include text.
Use relaxed alignment deliberately; strict SPF alignment breaks many subdomain setups.
Check DKIM d= alignment when DKIM passes but DMARC still fails for a daily stream.
Marketer from Email Geeks says 0% SPF alignment is possible when the sending platform uses a different envelope domain.
2024-02-03 - Email Geeks
Marketer from Email Geeks says several email platforms show SPF pass without SPF alignment unless custom bounce handling is configured.
2024-02-03 - Email Geeks
The practical takeaway
SPF alignment showing as 0% on Validity is usually not a platform error. It means the SPF-authenticated envelope sender domain does not match the visible From domain in the selected report scope, subject to the screen's grouping and rounding. SPF can still pass because SPF authenticates the envelope domain, not your From domain.
The correct response is to inspect headers, confirm whether DKIM is aligned, and then decide whether to configure a custom return-path domain. If DKIM is aligned and DMARC is passing, this is often a monitoring note. If DKIM is not aligned, it is a DMARC failure risk that needs a sender-side configuration change.
