DKIM Alignment Explained: Why 'DKIM-Signature Is Not Aligned' Happens

If your DMARC aggregate report shows dkim=pass next to dmarc=fail, or you've seen the phrase "DKIM-Signature is not aligned" in a header analysis, your DKIM key is working fine — it's alignment that's broken, not authentication.

These are two different checks, and mixing them up is the single biggest source of DMARC confusion. Here's what DKIM alignment actually checks, why it fails even when your signature is valid, and how to fix it.

DKIM Authentication vs DKIM Alignment

DMARC runs two separate evaluations against your DKIM signature, and only one of them is about whether the signature is "real":

1. DKIM authentication — Does the signature verify cryptographically against the public key published at selector._domainkey.d-domain? Was the message unaltered in transit? This confirms the signature is genuine.
2. DKIM alignment — Does the d= domain inside that valid signature match the domain in your visible From: header? This confirms the signer is who your recipient thinks sent the email.

A message can pass DKIM authentication 100% of the time and still fail DKIM alignment on every single send — because authentication only proves the signature is real, not that it belongs to your domain.

Why "DKIM-Signature Is Not Aligned" Happens

Your ESP signs with its own domain, not yours

This is the most common cause by far. If you send through an ESP without configuring custom DKIM, the ESP signs your mail with its own default selector — d=sendgrid.net, d=mailgun.org, d=amazonses.com, or similar. The signature authenticates fine (the ESP legitimately owns that key), but it doesn't align, because your From: header says yourcompany.com and the signature says otherwise.

You're using strict alignment (adkim=s)

DMARC's adkim= tag controls how exact the match has to be. With adkim=r (relaxed, the default), a subdomain relationship is enough — d=mail.yourcompany.com aligns with a From domain of yourcompany.com. With adkim=s (strict), the domains must match exactly. If you've set strict mode and one sending source signs from a subdomain, alignment fails for that source even though it's clearly your mail.

Email forwarding breaks the signature entirely

When a recipient's mail server forwards a message, it often modifies the body or headers slightly, which invalidates the original DKIM signature — it fails authentication outright, not just alignment. Some forwarders re-sign with their own domain, which then fails alignment too. This is a known limitation and one reason senders also configure SPF as a backup path, though SPF breaks similarly under forwarding.

Multiple sending sources, only one configured correctly

If you send transactional mail from one platform and newsletters from another, each needs its own custom DKIM setup. It's common to configure DKIM correctly for the main platform and forget the second one — that source will show DKIM-Signature not aligned in your reports while the first shows clean passes.

How to Diagnose a DKIM Alignment Failure

Read your DMARC aggregate reports

Your RUA reports are the ground truth. Look for rows where dkim_result = pass but dmarc_result = fail — that's a DKIM alignment failure specifically (as opposed to an authentication failure, where dkim_result itself would be fail). The report also shows the signing domain, so you can see exactly which d= value didn't match.

If you haven't set up reporting yet, add a rua tag to your DMARC record and keep the policy at p=none while you collect data:

_dmarc.yourdomain.com.  TXT  "v=DMARC1; p=none; rua=mailto:reports@yourdomain.com"

Check a raw header

Send a test message to a Gmail address, open it, click the three dots, and choose Show original. Look for a line like:

Authentication-Results: mx.google.com;
   dkim=pass header.i=@mailprovider.com header.s=selector1;
   dmarc=fail (p=quarantine) header.from=yourcompany.com

dkim=pass with header.i=@mailprovider.com tells you the signature verified for mailprovider.com — not your domain. That mismatch against header.from=yourcompany.com is the alignment failure.

Run a DNS scan

Before assuming alignment is the problem, confirm your DKIM record itself is published correctly — a malformed or missing DKIM TXT record causes authentication failures that can look similar in a quick read of a report. A free scanner can check SPF, DKIM, and DMARC together in a few seconds.

How to Fix DKIM Alignment

Set up custom (domain-branded) DKIM with your ESP

This is the real fix in nearly every case. Instead of letting your ESP sign with its own default key, configure it to sign with a key published on your domain:

1. In your ESP's settings, look for "custom DKIM," "domain authentication," or "branded links/DKIM" — most major platforms support this on free or low tiers.
2. The ESP gives you a CNAME or TXT record to publish, typically at selector._domainkey.yourdomain.com.
3. Once DNS propagates and the ESP verifies it, outgoing mail is signed with d=yourdomain.com instead of the ESP's domain.

After this, DKIM alignment passes because the d= domain and your From: domain match.

Switch to relaxed alignment if you're on strict

If you've set adkim=s and a legitimate sending source uses a subdomain, relax it:

_dmarc.yourdomain.com.  TXT  "v=DMARC1; p=quarantine; adkim=r; rua=mailto:reports@yourdomain.com"

Relaxed is the default — omitting adkim= entirely has the same effect.

Configure every sending source, not just the main one

List every platform that sends mail as your domain (transactional ESP, marketing/newsletter tool, CRM, helpdesk, billing system) and confirm each has custom DKIM configured. A single unconfigured source will keep showing up as misaligned in your reports even after you fix the others.

DKIM Alignment vs SPF Alignment — You Only Need One

DMARC passes if either SPF alignment or DKIM alignment passes — not both. In practice, DKIM alignment is the more reliable path because it survives forwarding better than SPF (DKIM signs the message content itself; SPF checks the sending IP, which a forwarder changes). Most senders end up relying on DKIM alignment as the primary path and treat SPF as a secondary signal.

Summary

DKIM alignment fails when a cryptographically valid DKIM signature carries a d= domain that doesn't match your From: header — most often because an ESP is signing with its own domain instead of yours. The fix is to configure custom DKIM signing on every platform that sends mail for your domain, confirm the d= domain matches in your headers and DMARC reports, and relax adkim= if a legitimate subdomain is being blocked.

Check your grade free

Don't guess what's broken — see it. Scan your domain free at emailsecuritygrade.com and get an instant A-F grade on your SPF, DKIM, DMARC, and MX records, with a plain-language fix for anything failing. No signup, no install — it runs in your browser.

If your emails are still landing in spam after fixing the records, a deliverability tool like InboxAlly can train mailbox providers to trust your sending — worth a look once your grade is solid.