Why does DMARC fail with SendGrid?

Their default bounce domain is theirs, not yours — SPF will not align until you add their branding CNAMEs. Same pattern for other ESPs with their own return paths.

Can I pass DMARC with only DKIM alignment?

Yes — you only need one aligned pass. SPF and DKIM do not both need to align.

Glossary

DMARC Alignment — Why It Fails and How to Fix It

Q: What is DMARC alignment?

From: must match the domain that passed SPF (Return-Path) or DKIM (d=). Miss either and DMARC fails.

Alignment means the domain people see in From: matches the domain that passed SPF (Return-Path) or DKIM (d=). Miss either and DMARC fails — super common when you blast mail through SendGrid or Mailchimp without their DNS pack.

SPF Alignment vs DKIM Alignment

SPF alignment = Return-Path domain matches From:. DKIM alignment = signing domain matches From:. You only need one to align for DMARC to smile.

Why Third-Party Senders Break Alignment

SendGrid’s default bounce domain is theirs, not yours — SPF won’t align until you CNAME-brand. Same story for other ESPs with their own return paths.

How to Fix DMARC Alignment

Each ESP wants different CNAMEs — rough map:

Google Workspace: usually lines up if From: is your Workspace domain
SendGrid: em#### + DKIM CNAMEs from their UI
Mailgun: region-specific CNAMEs from the control panel
Microsoft 365: selector1/selector2 DKIM CNAMEs

How to Check Alignment

Run DNS Preflight — we try to spot the ESP and show what’s missing.

Run the alignment check on your domain

Open DNS Preflight →