DKIM passing is not DKIM aligned
Why does my DKIM pass but DMARC fail?
In one sentence
A green “ pass” can still mean spam folder if the signature is not for the brand in the .
Emailrules interpretation
Your sending tool can sign mail with its own domain while the inbox shows you@yourbrand.com. Receivers may say the signature is valid ( pass) but still fail the brand check called — so fails and mail is untrusted. The fix is a branded sending domain so the signature matches what people see.
Why it matters. This is the classic “ says 100% delivered, humans never see it” bug. You only catch it in or a proper report.
Dotted words open definitions. See how email actually works.
What to do
Your move — not a lecture
Part platform, part you
The platform covers the mechanical bit. The judgement is still yours.
Configure a branded sending domain in Klaviyo, Braze or Mailchimp and is handled: the platform tells you the records to publish and signs as you afterwards.
Your part: Actually doing it, and then checking every other tool that sends as you. The invoicing system and the helpdesk are what catch people out, because nobody thinks of them as email.
What to do first
Send yourself a campaign, open the , and check the d= value matches your . Do not trust a green tick inside the sending platform.
You can skip this if: You have a branded sending domain configured in everything that sends as you, and somebody has actually read a aggregate report this quarter.
Who this applies to
Anyone who has not explicitly configured a branded sending domain, and anyone who has added a new sending tool since the last review.
Checklist
- 01Read a real received header and compare the d= value against your . Do not trust a green tick.
- 02Configure a branded sending domain in every platform that sends as you.
- 03Publish and then actually read the . Most agencies stop at p=none and never look again, which means new unauthorised senders go unnoticed for months.
That’s enough to act. The exact wording, the enforcement record and the primary source sit under Proof & sources, for counsel, bosses, or AI tools that need a citation. Not legal advice.
Proof
Exact position, enforcement, sources
For records and people who will check you. Skip if Monday’s move is already clear.
Source fact
Many platforms sign outgoing mail with their own sending domain by default. A header check then shows passing, while still fails, because the d= tag does not match the domain. The record existing is not the same as working, and dashboards will report 100 percent delivered while the mail lands in spam.
What happens if you do not
Enforced by filtering, silently. This is the single most common root cause we see in threads, and it is invisible from inside the sending platform.
Source
- RFC 7489, Domain-based Message Authentication, Reporting and Conformance (DMARC)Published 1 Mar 2015Read primary source
History of this page
- Re-verified against primary sources (bulk/auth/consent core).
- Added.
Related
Take this with you
GET https://emailrules.today/rules/dkim-alignment-vs-dkim-passing?format=json
Same URL, same answer, every field including the ones behind the Proof tab. An Accept: application/json header on the plain URL does the same thing. All the endpoints.