InboxGrade

DMARC strict DKIM alignment (adkim=s) failing on subdomain

Mail passes DKIM but fails DMARC because the signing domain `d=` does not exactly match the `From:` header domain required by `adkim=s`.

Impact — High impact

Messages are rejected or quarantined at the receiver even though DKIM itself verifies, because adkim=s requires the d= label to match the From: domain character-for-character. Transactional traffic from subdomains like mail.example.com disappears into spam folders or bounces outright, breaking password resets, receipts, and alerts. Aggregate rua reports will show dkim=pass paired with dkim.result=fail under policy_evaluated, which is the signature of this specific misconfiguration.

What causes it

  1. ESP signs with its own shared domain (d=sendgrid.net, d=amazonses.com, d=mailgun.org) instead of a customer-configured signing domain matching the From: header.
  2. Customer configured a DKIM selector on the organizational domain (example.com) but sends From: notifications@mail.example.com, where adkim=s demands exact label match.
  3. Subdomain inherits a parent DMARC policy with adkim=s via the organizational domain lookup, but the subdomain was never provisioned with its own DKIM key covering d=mail.example.com.
  4. A platform migration changed the signing d= value (for example from example.com to bounce.example.com) without updating the From: header or relaxing alignment.
  5. Mailing list or forwarder rewrites nothing but the message still carries a signature from a wholly unrelated domain (d=listserver.org), which strict alignment rejects outright.

How to fix it

Confirm the misalignment in message headers

Inspect Authentication-Results on a received message. A pass-but-misaligned signature shows DKIM pass with a d= value that is not identical to the From: domain. Compare the two values directly before changing any DNS.

Authentication-Results: mx.google.com;
  dkim=pass header.d=example.com header.s=s1;
  dmarc=fail (p=REJECT sp=REJECT dis=REJECT) header.from=mail.example.com

Publish a DKIM key for the exact sending subdomain

Create a DKIM selector record under the subdomain that appears in the From: header so d= matches exactly. Then configure the sending platform to sign with that key.

; In zone example.com
s1._domainkey.mail.example.com. IN TXT "v=DKIM1; k=rsa; p=MIIBIjANBgkq..."

Relax alignment if a subdomain key is not feasible

If the ESP will only sign with the organizational domain and you cannot migrate, switch the policy to adkim=r. Relaxed alignment accepts any d= within the same organizational domain. Keep aspf and p= unchanged.

_dmarc.mail.example.com. IN TXT "v=DMARC1; p=reject; adkim=r; aspf=s; rua=mailto:dmarc@example.com"

Verify after propagation with an external DMARC check

Send a test message from the production path to a mailbox at Gmail or Outlook.com and read the full headers. Both dkim=pass and dmarc=pass must appear, and header.d must align with header.from under your chosen alignment mode. Confirm aggregate reports to rua show policy_evaluated.dkim=pass the next day.

Fixed it? Run a fresh test to confirm.

Test my inbox →

Related errors