Passing SPF and DKIM can still fail DMARC

A message can pass SPF and DKIM and still fail DMARC. DMARC only counts a pass when the domain that passed matches the domain in your From line. Many sending tools sign DKIM with their own domain by default, so the check passes for them, not for you.

Quick test

• Send one email to a Gmail address.
• Open it and choose Show original.
• Look at the DKIM line. If the domain shown is your sending tool's instead of yours, set up custom DKIM in that tool's domain settings.

More on alignment and which policy to publish: DMARC policy for cold email.