Why is my DMARC failing even though DKIM and SPF pass in Sendgrid?
Matthew Whittaker
Co-founder & CTO, Suped
Published 14 May 2025
Updated 16 Aug 2025
7 min read
It can be incredibly frustrating when your DMARC reports show failures, especially when your SPF and DKIM records appear to be correctly set up and even pass authentication in SendGrid. Many senders encounter this perplexing issue, where everything seems to be in order, yet emails are still being blocked or quarantined.
This scenario often points to a misunderstanding of how DMARC actually works beyond just SPF and DKIM passing. While those records validate the sender, DMARC adds a crucial layer of security, requiring specific domain alignment that can sometimes be overlooked.
I'll explain the common reasons why this happens, focusing on the nuances of SendGrid's setup and email header analysis. The goal is to help you pinpoint the exact cause of your DMARC failures and implement effective solutions to ensure your emails reach their intended inboxes.
The true meaning of DMARC: authentication versus alignment
DMARC doesn't just check if SPF or DKIM are present and valid, it also requires that the domains used in these authentication checks align with the visible "From" domain of your email. This concept of alignment is often where the disconnect occurs when using third-party sending services like SendGrid.
SPF (Sender Policy Framework) verifies the sender's IP address against a list of authorized IPs for the domain in the "Return-Path" (or Mail From) header. DKIM (DomainKeys Identified Mail) uses cryptographic signatures to verify that an email was not altered in transit and was sent by an authorized domain, identified by the "d=" tag in the DKIM-Signature header. Both need to pass AND align.
When DMARC fails despite SPF and DKIM passing, it's almost always an alignment issue. The domain in your email's visible "From" header must match, or be a subdomain of, the domain validated by SPF (Return-Path) or DKIM (d= tag). If there's a mismatch, DMARC will fail.
Authentication pass
SPF: The sending IP is authorized by the Return-Path domain.
DKIM: The email's signature is valid and signed by the domain specified in the d= tag.
Alignment pass (for DMARC)
SPF alignment: The "Return-Path" domain matches (or is a subdomain of) the "From" header domain.
DKIM alignment: The DKIM "d=" domain matches (or is a subdomain of) the "From" header domain.
Decoding SendGrid's email headers and domain alignment
When you use SendGrid, or any other third-party email service provider (ESP), understanding how they handle your email's various header domains is critical. Your visible "From" address (RFC5322.From or "Header From") is what recipients see, for example, "yourname@yourdomain.com".
However, the domain used for SPF authentication (RFC5321.MailFrom or "Return-Path") might be different. SendGrid often uses a subdomain of sendgrid.net for the Return-Path by default, such as "bounces.sendgrid.net" or a similar bounce domain. If your DMARC policy requires strict SPF alignment (aspf=s), this mismatch will cause DMARC to fail, even if the SPF record itself passes for sendgrid.net.
Similarly, for DKIM, the "d=" tag in the DKIM-Signature header indicates the domain that signed the email. If you haven't fully configured domain authentication in SendGrid, it might sign emails with a sendgrid.net domain. Even if this DKIM signature is valid (dkim=pass), DMARC will fail if "yourdomain.com" (Header From) does not align with "sendgrid.net" (d= tag). This is a common pitfall when third-party providers use their own signing domain.
Here's an example of email headers showing this type of misalignment:
Example DMARC Failure Headerstext
Authentication-Results: spf=pass (sender IP is 168.245.114.230)
smtp.mailfrom=sendgrid.net; dkim=pass (signature was verified)
header.d=sendgrid.net;dmarc=fail action=oreject
header.from=yourdomain.com;compauth=fail reason=000
In this example, both SPF and DKIM pass for sendgrid.net, but the DMARC fails because "yourdomain.com" (the Header From) does not align with sendgrid.net.
Common culprits behind DMARC alignment failures with SendGrid
The primary reason DMARC fails in SendGrid when SPF and DKIM pass is almost always due to incorrect domain authentication or subuser configuration. SendGrid offers a domain authentication feature that allows you to configure your DNS records (CNAMEs) so that SendGrid can send emails on your behalf, aligning the Return-Path and DKIM signature domains with your sending domain.
A common mistake is verifying the domain in SendGrid's main account but failing to assign it to the specific subuser sending the emails. If a subuser attempts to send an email from a domain that hasn't been explicitly assigned to them, SendGrid might default to signing the email with a SendGrid domain, causing DMARC alignment issues.
Another subtle issue can be the DMARC policy's alignment mode. DMARC allows for either relaxed (s=r) or strict (s=s) alignment. Strict alignment requires an exact match between the organizational domains, while relaxed allows for subdomain matches. For example, with relaxed alignment, an email from "news.yourdomain.com" could align with a DKIM signature from "yourdomain.com". If you're on a strict policy, even a legitimate subdomain might fail alignment if not explicitly covered.
Best practices for DMARC alignment in SendGrid
Verify full domain authentication: Ensure all CNAME records from SendGrid are correctly published in your DNS for your sending domain. This includes records for DKIM, SPF (Return-Path), and sometimes custom tracking domains.
Subuser domain assignment: If you use SendGrid subusers, confirm that the authenticated domain is explicitly assigned to the subuser account that is sending the emails.
Check DMARC policy alignment mode: While strict alignment offers stronger protection, consider starting with a relaxed mode (aspf=r, adkim=r) if you use subdomains for sending, or if your ESP's default configuration makes strict alignment challenging.
Steps to diagnose and resolve DMARC failures
To effectively troubleshoot and resolve DMARC failures, start by re-evaluating your SendGrid domain authentication settings. Log into your SendGrid account and navigate to the Sender Authentication section. Ensure that your sending domain is fully authenticated, meaning all required CNAME records are published and verified in your DNS.
If you're using subusers in SendGrid, this step is critical. Even if the root domain is authenticated, you must explicitly assign that domain to the specific subuser account that will be sending emails. Without this assignment, SendGrid may not use your domain's DKIM keys and Return-Path, leading to alignment failures.
You can also use an email deliverability tester to send an email through SendGrid and analyze its headers. This will show you exactly which domains are being used for SPF (Return-Path) and DKIM (d= tag) and how they compare to your Header From domain, helping you identify any misalignment. Checking your DMARC reports is also essential, as they provide aggregated data on why emails are failing DMARC checks, often indicating alignment issues.
Here's a quick guide to common checks:
Check Item
Action in SendGrid
DNS Impact
DMARC Alignment Focus
Domain authentication status
Verify all SendGrid CNAME records are green.
Ensure all CNAMEs are present and propagated.
Enables SendGrid to sign with your domain.
Subuser domain assignment
Confirm domain is assigned to the sending subuser.
No direct DNS change, but critical for SendGrid's usage of records.
Ensures Return-Path and DKIM d= align with Header From.
Email header analysis
Send a test email and inspect headers for "Authentication-Results" and alignment.
Reveals actual domains used for SPF and DKIM.
Identifies if "Header From" matches SPF/DKIM domains.
Views from the trenches
If you've confirmed that your DNS records for SPF and DKIM are correctly published for your domain and verified in SendGrid's UI, and yet DMARC is still failing, the issue most likely lies within SendGrid's internal configuration for your sending account or subusers.
The key takeaway is that authentication success (SPF=pass, DKIM=pass) doesn't automatically imply DMARC alignment. For DMARC to pass, the domains in the SPF Return-Path and/or DKIM d= tag must align with your email's visible "From" domain. If SendGrid is still using its own domain for these headers, even if the SPF and DKIM checks pass, your DMARC will fail.
Best practices
Always complete SendGrid's full domain authentication process to ensure proper alignment of SPF and DKIM.
If using subusers, explicitly assign the authenticated sending domain to each subuser.
Regularly monitor your DMARC reports to catch any alignment issues early and prevent deliverability problems.
Use a DMARC monitoring tool to simplify the analysis of aggregate and forensic reports.
Common pitfalls
Assuming SPF and DKIM passing means DMARC will automatically pass, neglecting domain alignment.
Not assigning authenticated domains to SendGrid subusers, leading to default SendGrid domain signing.
Ignoring DMARC reports or not understanding their detailed breakdown of authentication and alignment.
Setting a DMARC `p=reject` policy prematurely without verifying full alignment.
Expert tips
Inspect raw email headers for SPF's Return-Path and DKIM's d= tag to confirm what domains are being used.
Utilize SendGrid's official documentation for domain authentication and subuser management to ensure correct setup.
If issues persist, contact SendGrid support with specific header examples and your domain authentication setup details.
Remember that Microsoft (Outlook.com, Outlook 365) often sends DMARC failed messages to junk/bulk folders rather than rejecting them outright, which can be useful for testing.
Marketer view
Marketer from Email Geeks says they were seeing DMARC failures even though their SendGrid configuration validated. Their client had a reject DMARC policy, leading to emails getting blocked entirely.
2022-09-27 - Email Geeks
Expert view
Expert from Email Geeks says that inspecting the email headers is crucial, specifically checking if the DKIM d= domain aligns with the RFC5322.From domain.
2022-09-27 - Email Geeks
Achieving DMARC compliance with SendGrid
Navigating DMARC failures when SPF and DKIM seemingly pass can be a complex challenge, especially when using ESPs like SendGrid. The critical factor is almost always domain alignment, ensuring that the domains used for SPF (Return-Path) and DKIM (d= tag) match your visible "From" domain.
By thoroughly reviewing your SendGrid domain authentication, paying close attention to subuser assignments, and analyzing email headers for alignment issues, you can diagnose and resolve these problems. Consistent monitoring of your DMARC reports is also essential for maintaining strong email deliverability and protecting your brand's reputation.
sendgrid.net for the Return-Path by default, such as "bounces.sendgrid.net" or a similar bounce domain. If your DMARC policy requires strict SPF alignment (aspf=s), this mismatch will cause DMARC to fail, even if the SPF record itself passes for 
