Skip to content
ZeroHook | SecurityTools

What should I do

Fix DMARC alignment

Make a passing check use a domain that aligns with the header From. Passing SPF on a different domain does not satisfy DMARC.

  • Read the authenticated domain, not only the pass. SPF's domain is the MAIL FROM domain. DKIM's domain is d=.
  • Relaxed mode, the default, needs the same organizational domain. Strict mode needs the same fully qualified domain.
  • One aligned, verifying DKIM signature is enough for a DMARC pass, even if other signatures fail. RFC 7489 says any aligned signature that verifies is a pass.