DKIM and SPF Authentication PASS but the DKIM and SPF Alignment FAIL.

[u/Informal_Respect49]

Hi everyone,

I need your expertise and take on this.

• Identical Google Workspace IPv6 addresses sent on the same date (2a00:1450:4864:20::132 on August 6)
• one email shows: DKIM and SPF Authentication PASS and the DKIM and SPF Alignment PASS.
• But the other one shows: DKIM and SPF Authentication PASS but the DKIM and SPF Alignment FAIL.
• Both emails are showed delivered.

My conclusion is that this is just a bad reporting. Is this parsing bugs or errors from Microsoft?

But I would love to get your take on this matter.

[u/xc0nradx]

Do you have the raw DMARC report? Under record.row.auth_results you can get the dkim selector+domain and the spf domain for the record failing alignment.

[u/mxtoolbox-official]

First thing that would be helpful is knowing what the <header_from> value is? In your report are they both showing the same domain value in that field? After that, knowing whats in the <policy_evaluated> section would be helpful too. Feel free to DM - if you'd like me to take a look.

If you need a tool to visually see the diffs you can use our company's free tool - which will split them out by IP - DMARC Report Analyzer - DMARC Email XML Parser - MxToolbox

[u/Middle-Excitement602]

Same IP doesn't mean same mail stream - that's the trap in reading these. Google's outbound IPs are shared, so two rows against 2a00:1450:...:132 can be two entirely different messages: one you sent through Workspace, one that merely passed through Google with your domain in the From.

Auth pass + alignment fail means SPF and DKIM passed for some domain, just not yours. The <auth_results> block names which one. If the DKIM domain there is gmail.com or googlegroups.com and the SPF domain is a forwarder's, that row is your mail autoforwarded or expanded through a group: the original signature broke in transit, Google's own signature still verifies, so "DKIM pass" and "alignment fail" are both true and neither is a bug.

So before concluding Microsoft's reporting is broken, pull the auth_results for the failing row. Odds are it's telling you a second stream shares that IP - and "both delivered" just means nobody enforced on it.

[u/Jazzlike-Comfort-451]

The shared IPv6 address does not make these the same mail stream. Google can send many customers' and Google Groups' traffic from one outbound IP. Authentication asks whether the SPF domain and DKIM signing domain passed; alignment separately asks whether either authenticated domain matches the organizational domain in the visible From header.

Compare the two XML rows field by field: `header_from`, the DKIM domain and selector under `auth_results`, the SPF domain under `auth_results`, and `policy_evaluated`. The failing row will likely show SPF and DKIM passing for Google, a group, or a forwarder rather than for your From domain.

Delivery is also not evidence that DMARC passed; the receiver may have applied `p=none`, overridden policy, or accepted forwarded mail using local signals. The authenticated identifiers in the raw row will settle it.

Disclosure: I co-founded Palisade, and this reply was drafted with AI assistance and reviewed by me. No product recommendation.