In forcesince 1 Mar 2015 · Global
DKIM passing is not DKIM aligned
Many platforms sign outgoing mail with their own sending domain by default. A header check then shows DKIM passing, while DMARC still fails, because the d= tag does not match the From address domain. The record existing is not the same as alignment working, and dashboards will report 100 percent delivered while the mail lands in spam.
Who this applies to
Anyone who has not explicitly configured a branded sending domain, and anyone who has added a new sending tool since the last DNS review.
What to do
- Read a real received header and compare the d= value against your From domain. Do not trust a green tick.
- Configure a branded sending domain in every platform that sends as you.
- Publish DMARC and then actually read the aggregate reports. Most agencies stop at p=none and never look again, which means new unauthorised senders go unnoticed for months.
What happens if you do not
Enforced by filtering, silently. This is the single most common root cause in the deliverability threads I read, and it is invisible from inside the sending platform.
Source
- RFC 7489, Domain-based Message Authentication, Reporting and Conformance (DMARC)Published 1 Mar 2015Read it
Related
History of this page
- Added.