DKIM signing domain does not match From domain (alignment fail)

The DKIM `d=` tag identifies a domain that does not align with the `From:` header domain, so DMARC cannot pass via DKIM even though the signature itself verifies.

Impact — High impact

DMARC evaluation requires at least one of SPF or DKIM to both pass and align with the From: domain. When d= points to a sending provider's domain (for example sendgrid.net or mailgun.org) instead of your organizational domain, DKIM is reported as pass but dkim=fail under DMARC alignment. If SPF is also unaligned, DMARC fails outright and mail is quarantined or rejected under a p=quarantine or p=reject policy — most commonly affecting transactional mail, password resets, and vendor-sent notifications.

What causes it

ESP or transactional provider (SendGrid, Mailgun, Amazon SES, Postmark, Mailchimp) is signing with its default shared domain instead of a configured custom signing domain under your From: domain.
Custom DKIM was set up on a subdomain (e.g. mail.example.com) while messages are sent From: user@example.com, producing a relaxed-alignment mismatch only under adkim=s (strict).
DNS records for the branded DKIM CNAMEs were never published, so the provider silently fell back to signing with its own domain.
Multiple sending platforms are in use and only some have been configured for aligned DKIM; the unaligned platform's traffic fails DMARC.
A recent domain rename, merger, or From: domain change left DKIM selectors still pointing at the old organizational domain.

How to fix it

Confirm the alignment failure in headers

Open the raw headers of a failing message and compare the From: domain to the d= tag inside DKIM-Signature. If they differ (and neither is a parent of the other under relaxed alignment), that is the alignment failure. Cross-check against a DMARC aggregate (RUA) report entry showing dkim.result=pass but dkim.alignment=fail.

grep -iE '^(From|DKIM-Signature):' message.eml

Enable branded (custom) DKIM at your sending provider

In the provider's dashboard, enable Sender Authentication / Domain Authentication / Custom DKIM for your From: domain. The provider will issue one or more CNAME (occasionally TXT) records whose hostnames sit under your domain. Publish them in DNS exactly as given — do not add trailing dots, quotes, or wrap the values.

s1._domainkey.example.com.  CNAME  s1.domainkey.u1234567.wl.sendgrid.net.
s2._domainkey.example.com.  CNAME  s2.domainkey.u1234567.wl.sendgrid.net.

Verify the published selector resolves and signs under your domain

Query the selector directly, then send a test message and inspect the resulting d= value. The d= tag must equal your From: organizational domain (or a subdomain of it when adkim=r).

dig +short TXT selector._domainkey.example.com
swaks --to probe@dmarc-tester.com --from noreply@example.com --server smtp.provider.net

Match your DMARC alignment mode to your DKIM topology

If DKIM must sign with a subdomain like mail.example.com while From: uses the bare example.com, keep DMARC on relaxed alignment (adkim=r, the default). Only switch to adkim=s after confirming every sending stream signs with the exact organizational domain.

_dmarc.example.com. TXT "v=DMARC1; p=reject; adkim=r; aspf=r; rua=mailto:dmarc@example.com"

Fixed it? Run a fresh test to confirm.

Test my inbox →