Fix guide

How to Fix DMARC Alignment for Proofpoint

Running Proofpoint in front of mail? Match their DKIM/signing settings to your From: domain and keep SPF honest — this page is the checklist.

Why Proofpoint + DMARC gets messy

Gateways rewrite paths — keep DKIM d= and SPF consistent with what you actually send, or alignment flakes under policy.

DKIM TXT at selectors Proofpoint provides SPF: authorize all legitimate sending paths (consult Proofpoint for your topology)

Step 1 Proofpoint → Email Authentication / DKIM settings (path varies by product)

Step 2 Enable DKIM signing for each sending domain

Step 3 Add selector TXT records Proofpoint provides

Step 4 Ensure SPF includes authorized hops for your mail flow

Step 5 Send test mail and inspect Authentication-Results headers

Step 6 Confirm public DKIM and SPF with DNS Preflight

Run your domain through DNS Preflight

Related glossary: DMARC · DMARC alignment · DKIM · SPF record

Relays change which IP and envelope domain receivers see. Work with Proofpoint documentation for your deployment so SPF and DKIM d= align with From:.

Use the admin console for your Proofpoint product to generate keys and publish DNS TXT records at the given selectors.

Return-Path and sending IP must match your SPF design; complex relays may need SRS or aligned bounce domains — consult Proofpoint support.

Enterprise mail paths often involve multiple hops and gateways — alignment must be validated end-to-end.

Inspect headers on test messages, use DMARC reports, and DNS Preflight for published DNS.