Using a DMARC Checker to Identify and Fix Alignment Issues in Multi-Domain Environments

15 October 2026 · DMARC Engine · 11 min read

Identifying Alignment Issues with a DMARC Checker

To identify alignment issues in a multi-domain environment, a DMARC checker is an essential tool. It analyses the domain's DMARC, SPF, and DKIM records to determine if they are correctly aligned. Alignment issues occur when the domain in the From header does not match the domain in the SPF or DKIM record. For instance, if the From header is example.com but the SPF record is set up for subdomain.example.com, this will cause an alignment issue.

example.com. IN TXT "v=spf1 include:subdomain.example.com -all"

This record will not align with the From header example.com, as the SPF record is set up for subdomain.example.com. A DMARC checker will flag this as an alignment issue.

When using a hosted or managed setup, such as DMARC Engine, the alignment issues are often handled automatically. However, it is still crucial to regularly check the DMARC reports to ensure that the alignment is correct. A DMARC checker can be used to scan the domain's DNS records and identify any alignment issues.

example.com. IN TXT "v=dmarc1; p=none; rua=mailto:example@example.com"

This DMARC record is set to monitor mode, which means it will not block any emails but will send aggregate reports to the specified email address. The DMARC checker can then analyse these reports to identify any alignment issues.

Tip: Regularly checking the DMARC reports and using a DMARC checker can help identify alignment issues before they cause problems with email delivery.

To fix alignment issues, it is essential to ensure that the SPF and DKIM records are set up correctly for the domain in the From header. This may involve updating the SPF record to include the domain or setting up a new DKIM record for the domain. A DMARC checker can help identify the correct changes to make to fix the alignment issues.

import dns.resolver

answers = dns.resolver.resolve('example.com', 'TXT')
for rdata in answers:
 for txt_string in rdata.strings:
 print(txt_string)

Understanding DMARC Alignment in Multi-Domain Environments

In a multi-domain environment, ensuring DMARC alignment can be complex, particularly when dealing with subdomains and third-party senders. For instance, a company with the domain example.com may have subdomains such as mail.example.com, blog.example.com, and shop.example.com, each potentially sending emails. To achieve alignment, the domain owner must ensure that the SPF and DKIM records are properly configured for each domain and subdomain.

A key consideration is the organisational domain, which is the domain that is listed in the From header of an email, and the domain that DMARC checks for alignment. For example, if an email is sent from the address user@mail.example.com, the organisational domain is example.com. To align with DMARC, the domain owner must configure the SPF and DKIM records for example.com, as well as any subdomains that send emails.

example.com. IN TXT "v=spf1 include:_spf.example.com -all"

In a hosted or managed setup, the provider may handle some of these configurations, but it is still crucial for the domain owner to understand the setup and ensure alignment. For DKIM, the domain owner must generate a public-private key pair and publish the public key in a DNS record, such as:

selector._domainkey.example.com. IN TXT "v=DKIM1; k=rsa; p=MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCqGKukO1De7zhZj6+H0qtjTkVxwTCpvKe4eCZ0FPqri0cb2JZfXJ/DgYSF6vUpwmJG8wVQZKjeGcjDOL5UlsuusFncCzWBQ7RKNUSesmQRMSGkVb1/3j+skZ6UtW+5u09lHNsj6tQ51s1SPrCBkedbNf0Tp0GbMJDyR4e9T04ZZwIDAQAB"

Warning: Failing to properly configure DMARC alignment can lead to emails being rejected or marked as spam, resulting in deliverability issues and potential revenue loss.

Using Aggregate Reports to Inform DMARC Checker Decisions

When operating a DMARC checker in a multi-domain environment, aggregate reports are crucial for identifying and fixing alignment issues. These reports, typically sent to the email address specified in the DMARC record, contain valuable information about email authentication results, including pass and fail rates for SPF and DKIM. For instance, a DMARC record like the following:

_dmarc.example.com. IN TXT "v=DMARC1; p=none; rua=mailto:aggregate@example.com; ruf=mailto:forensic@example.com; fo=1"

will send aggregate reports to aggregate@example.com.

In a hosted or managed setup, such as the one we operate at DMARC Engine, these reports are often automatically processed and presented in a user-friendly format, allowing for easier analysis and decision-making. However, when handling these reports manually, it's essential to understand how to extract relevant information and use it to inform DMARC checker decisions. One common challenge is dealing with false negatives, where legitimate emails are incorrectly flagged as spam or rejected due to alignment issues.

To mitigate this, we recommend carefully reviewing aggregate reports to identify patterns and trends that may indicate alignment problems. For example, if a report shows a high rate of SPF failures from a specific IP address, it may be necessary to update the SPF record to include that address. Here is an example of what an SPF record update might look like:

example.com. IN TXT "v=spf1 ip4:192.0.2.1 ip4:198.51.100.1 include:_spf.example.net -all"

This record includes two IP addresses and an include statement for another domain's SPF record.

When using aggregate reports to inform DMARC checker decisions, it's also important to consider the impact of policy updates on email deliverability. For instance, switching from p=none to p=quarantine or p=reject can significantly affect how receiving mail servers handle emails that fail DMARC checks. We advise a gradual approach, starting with p=none to monitor and analyse results, then moving to p=quarantine before finally implementing p=reject. This staged approach helps minimise disruptions to email services.

Tip: Always ensure that DMARC, SPF, and DKIM records are published on domains you control, rather than on a hosting or email provider's own hostname, to maintain full control over your email authentication settings.

Here are some key points to keep in mind when using aggregate reports:

* Regularly review aggregate reports to identify trends and patterns indicating alignment issues
* Update SPF and DKIM records as necessary to ensure proper alignment
* Gradually implement DMARC policies to avoid disrupting email services
* Monitor email deliverability and adjust policies accordingly

import csv

# Example of parsing an aggregate report CSV file
with open('aggregate_report.csv', 'r') as file:
 reader = csv.DictReader(file)
 for row in reader:
 print(row['source_ip'], row['spf_result'], row['dkim_result'])

This Python snippet demonstrates how to parse an aggregate report CSV file, which can be useful for automating the analysis of these reports.

By effectively utilising aggregate reports and following a structured approach to DMARC checker decisions, organisations can significantly improve their email authentication posture and reduce the risk of spoofing and spam.

Step-by-Step Guide to Fixing Alignment Issues

To fix alignment issues in a multi-domain environment, you need to identify the domains and mail streams that are not aligned, and then update the DNS records accordingly. Start by using a DMARC checker to identify the domains and mail streams that are not aligned. The checker will provide you with a list of domains and mail streams that are not passing DMARC, along with the reason for the failure.

_dmarc.example.com. IN TXT "v=DMARC1; p=none; pct=100; rua=mailto:dmarc@example.com; ruf=mailto:dmarc@example.com; fo=1"

For example, if you have a domain example.com and a subdomain sub.example.com, and you are using a third-party email service provider to send emails from sub.example.com, you may need to add a TXT record to the subdomain to align it with the parent domain.

_dmarc.sub.example.com. IN TXT "v=DMARC1; p=none; pct=100; rua=mailto:dmarc@example.com; ruf=mailto:dmarc@example.com; fo=1"

You should also check the SPF and DKIM records for the domain and subdomain to ensure they are correctly configured. For SPF, you need to ensure that the IP addresses of the third-party email service provider are included in the SPF record.

example.com. IN TXT "v=spf1 include:_spf.example.net -all"

For DKIM, you need to ensure that the selector record is correctly configured and that the public key is correctly published in the DNS.

selector._domainkey.example.com. IN TXT "v=DKIM1; k=rsa; p=MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCq3NLGmckOr4bD0q2nfY8T3eU5Rb4R9Z4KxCSzkeK5y8xYb5mJYnK4x4SC1rYqKJjNl0aFw4rD5TlM7i5Kf4Rk4R9Z4K"

Warning: do not publish DNS records on a hosting or email provider's own hostname, as this can cause alignment issues and make it difficult to troubleshoot problems.

When updating the DNS records, you should start by updating the records for the subdomain, and then update the records for the parent domain. You should also ensure that you are using a valid DKIM selector, and that the selector is correctly configured in the DNS.

It is also important to note that some hosted or managed setups may handle alignment issues differently. For example, some email service providers may automatically configure the SPF and DKIM records for you, while others may require you to configure them manually.

In general, it is a good idea to start with a relaxed DMARC policy, such as p=none, and then gradually increase the policy to p=quarantine and finally p=reject, once you are confident that all mail streams are aligned.

You should also ensure that you are monitoring the DMARC reports regularly, to identify any alignment issues and update the DNS records accordingly.

By following these steps, you can fix alignment issues in a multi-domain environment and ensure that your emails are authenticated correctly.

List of common alignment issues:

• SPF record not including the IP address of the third-party email service provider
• DKIM selector record not correctly configured
• DMARC record not correctly configured
• Subdomain not aligned with parent domain

_dmarc.example.com. IN TXT "v=DMARC1; p=quarantine; pct=100; rua=mailto:dmarc@example.com; ruf=mailto:dmarc@example.com; fo=1"

Trade-Offs and Considerations for DMARC Policy Updates

When updating DMARC policies, organisations must carefully consider the trade-offs between security and deliverability. For instance, moving from a monitoring policy to a reject policy can prevent phishing attacks, but may also cause legitimate emails to be blocked if they fail DMARC validation.

_dmarc.example.com. IN TXT "v=DMARC1; p=reject; pct=100; rua=mailto:aggregatereports@example.com; ruf=mailto:forensicreports@example.com; fo=1"

A hosted or managed setup, such as ours at DMARC Engine, can help mitigate these risks by providing detailed reporting and analytics to inform policy updates.

Tip:
> When updating DMARC policies, it is essential to gradually increase the policy strength, starting with a monitoring policy, then moving to a quarantine policy, and finally to a reject policy, to avoid inadvertently blocking legitimate emails.

Organisations should also consider the potential impact on their email ecosystem, including the effects on mailing lists, automated emails, and emails sent via third-party services. By carefully evaluating these trade-offs and considerations, organisations can effectively update their DMARC policies to achieve optimal security and deliverability.

Real-World Examples of DMARC Checker Output and DNS Records

When using a DMARC checker to identify alignment issues in multi-domain environments, it is crucial to understand the output and how it relates to your DNS records. For instance, a DMARC checker may report an alignment issue with a subdomain, such as sub.example.com, due to a missing or misconfigured SPF record. In this case, the checker output may indicate that the SPF record for example.com is not aligned with the subdomain, resulting in a DMARC failure.

example.com. IN TXT "v=spf1 include:_spf.example.com -all"

To fix this issue, you would need to add an SPF record for the subdomain, such as sub.example.com, that includes the same IP addresses or hostnames as the parent domain. Alternatively, you can use a wildcard SPF record, such as *.example.com, to cover all subdomains.

*.example.com. IN TXT "v=spf1 include:_spf.example.com -all"

Another common issue encountered when using a DMARC checker is DKIM alignment problems. For example, if your email service provider uses a different domain for DKIM signing, such as mail.example.com, the DMARC checker may report an alignment issue if the DKIM record is not properly configured. To resolve this, you would need to add a DKIM record for the signing domain, such as mail.example.com, and ensure that it is properly aligned with your DMARC policy.

dmarc_record = {
 "domain": "example.com",
 "p": "none",
 "sp": "none",
 "adkim": "r",
 "aspf": "r"
}

In a hosted or managed setup, such as with a third-party email service provider, the DMARC checker output may indicate that the provider's domain is not aligned with your own domain. In this case, you would need to work with the provider to ensure that their domain is properly configured and aligned with your DMARC policy.

_dmarc.example.com. IN TXT "v=DMARC1; p=none; sp=none; adkim=r; aspf=r"

Tip: When troubleshooting DMARC alignment issues, it is essential to verify that your DNS records are properly configured and propagated, as this can significantly impact the accuracy of the DMARC checker output.

dig +short _dmarc.example.com TXT

Monitoring and Maintaining DMARC Alignment Over Time

To ensure ongoing DMARC alignment, regular monitoring of aggregate reports is crucial. In a multi-domain environment, this involves checking reports for each domain, as alignment issues can arise from various sources, such as new mail servers or changes in SPF records. For example, a change in the SPF record for a subdomain can cause alignment issues if not properly updated.

example.com. IN TXT "v=spf1 a mx ip4:192.0.2.1 include:_spf.example.com -all"

A hosted DMARC setup, such as the one provided by DMARC Engine, can simplify this process by providing a centralised dashboard for monitoring aggregate reports across multiple domains.

Tip:
> Regularly review aggregate reports to identify potential alignment issues before they become major problems, and update DNS records as necessary to maintain alignment.

Related reading