How to Check DMARC Alignment for Cold Email Domains
DMARC can fail even when SPF and DKIM both pass. Alignment is the missing link — here's how to verify it and fix it when it's broken.
You have DMARC set up and it shows some kind of status in email headers, but you want to verify that alignment is actually working the way it needs to for your cold email infrastructure. DMARC alignment is the mechanism that connects your From header domain to either your SPF domain or your DKIM domain — without it, DMARC can fail even if SPF and DKIM pass individually.
How DMARC alignment works
SPF alignment: The domain in the envelope sender (Return-Path or MAIL FROM) must match the domain in the From header. "Match" can mean exact match (strict alignment) or organizational domain match (relaxed alignment, which is the default).
DKIM alignment: The domain in the DKIM signature's d= tag must match the domain in the From header. Same strict vs relaxed alignment rules apply.
DMARC passes if either SPF alignment or DKIM alignment passes. It does not require both, but having both aligned is ideal for maximum deliverability.
Step-by-step verification
Step 1: Send a test email to Gmail
Send a test email from your cold email inbox to a personal Gmail account you control. Open the email in Gmail. Click the three dots, then "Show original."
Step 2: Check Authentication-Results
Look for the Authentication-Results header. It will show SPF, DKIM, and DMARC results. Good result: spf=pass dkim=pass dmarc=pass. Problem: dmarc=fail despite SPF and DKIM both passing individually — this means alignment is broken.
Step 3: Check SPF domain alignment
Check the Return-Path (envelope sender) domain and compare it to your From header domain. If they match at the organizational domain level (same root domain, subdomains count with relaxed alignment), SPF alignment passes.
Step 4: Check DKIM domain alignment
Check the DKIM d= value and compare it to your From header domain. Use the DKIM checker to view the selector and d= value from your domain.
Step 5: Use the DMARC lookup
Check your DMARC record with the DMARC lookup. Verify the alignment settings (aspf and adkim) — relaxed (r) is usually correct and allows subdomains to align with the organizational domain.
Common alignment problems
- Your outreach tool sends email using its own envelope sender domain. The From header shows your domain, but the Return-Path is something like
bounce@outreachtool.com. SPF passes for the outreach tool's domain, but alignment with your From domain fails. - Your DKIM signature uses the outreach tool's domain in the
d=tag rather than your domain. DKIM passes for their domain, but alignment with your From domain fails. - Subdomain mismatch with strict alignment. If using
outreach@cold.yourdomain.comin From but SPF and DKIM are set up foryourdomain.com— relaxed alignment handles this, but strict alignment would fail.
The fix path
Configure your outreach tool to use your domain as the envelope sender. This often involves adding DNS records that let the tool send on behalf of your domain. Configure your outreach tool to sign with your domain's DKIM key. Most tools support custom DKIM signing.
Use relaxed alignment in your DMARC record (aspf=r; adkim=r). This is the default and allows subdomains to align with the organizational domain.
Test after every change by sending to a Gmail account and checking the original message headers.
Repair or replace?
Alignment issues are always repairable through DNS and outreach tool configuration. You do not need to replace infrastructure for alignment problems. Fix the configuration and alignment starts passing immediately after DNS propagation.
Run the checks first
Before replacing anything, run a free inbox placement test. You might find the issue is DNS, not the domain — and save yourself a week of unnecessary work.