DKIM Alignment: Why "Signing" Isn't Enough

"DKIM" sounds reassuring: your email is digitally signed, so it must authenticate. But DMARC has a stricter requirement than "a signature exists." The signature must be aligned with the domain in the From header. Sign with the wrong domain, or fail to cover the From address, and your mail can carry a valid DKIM signature and still fail DMARC.

This guide explains what DKIM alignment is, why it trips people up, and how to check and fix it.

What DKIM does

DKIM (DomainKeys Identified Mail) lets a domain cryptographically sign the content and headers of an email. A receiving server looks up the signing domain's public key in DNS and verifies the signature, proving the message wasn't tampered with after signing and was sent by someone holding the private key.

A DKIM signature header (DKIM-Signature:) includes:

• d= — the signing domain.
• s= — the selector used to find the public key.
• h= — the signed headers (which headers the signature covers).

What "alignment" means

DMARC doesn't just ask "is there a DKIM signature?" It asks: does the signing domain match the From domain?

The From header is the address a recipient sees as the sender, e.g. From: hello@yourdomain.com. For DMARC's DKIM check to pass:

• The DKIM d= domain must exactly match the From domain (strict alignment), or
• The d= domain must be a subdomain of the From domain (relaxed alignment).

If d= is mailer.thirdparty.com but the From is yourdomain.com, that's a misalignment — the DKIM signature exists but does not satisfy DMARC.

Why your mail can fail even when signed

Two common scenarios:

1. Third-party sender signs with its own domain. You send through an email provider that signs with its own domain (d=provider.com) while your From is yourdomain.com. The message is signed, but not aligned — so DMARC's DKIM check fails.

2. The From header isn't covered by the signature. DKIM signs the headers in h=. If the From header wasn't among them (or was modified after signing), the signature is invalid for DMARC purposes even if it "verifies."

How to check alignment

You can verify DKIM alignment with a lookup plus the message headers:

1. Find the signing domain — look at d= in the DKIM-Signature: header.
2. Compare it to the From domain. They must match or be an aligned subdomain.
3. Check the selector — the public key must exist at s._domainkey.<d=domain>.
4. Verify the signature — your DKIM inspector (/tools/dkim-inspector) checks the selector's key length and flags; a full header check tells you if it verifies and is aligned.

Fixing alignment

1. Sign with the From domain. Configure your email provider to sign with yourdomain.com (most let you set up DKIM for your own domain and sign with it).
2. Or use an aligned subdomain. If you must sign with a subdomain, make it a subdomain of the From domain (e.g. From: user@yourdomain.com, d=mail.yourdomain.com).
3. Ensure the From header is signed. Confirm h= includes from.
4. Check SPF too. DMARC passes if either SPF or DKIM is aligned — so a properly aligned SPF can carry a message even when DKIM isn't aligned. But you should fix both for reliability.

The takeaway

DKIM signing alone isn't enough for DMARC — the signature must be aligned with the From domain. Check that d= matches your From domain (or an aligned subdomain), that the From header is covered by the signature, and that the selector's key is valid. Get alignment right and your DMARC policy will actually authenticate your mail instead of failing it.

Next, read the DMARC migration guide to enforce a policy, and make sure your SPF is healthy too.