What's the difference between DKIM alignment and DKIM verification?

Verification confirms the signature is cryptographically intact and the message wasn't tampered with. Alignment confirms the signing (d=) domain matches the visible From: domain. Verification can pass while alignment fails — which is why a report can read dkim=pass and still contribute a DMARC failure.

Can I use a subdomain for DKIM signing and still pass alignment?

Yes. Under relaxed alignment a subdomain aligns with its organizational parent, so signing as mail.example.com aligns with a From: of example.com. The reverse doesn't hold, and strict alignment requires the domains to match exactly.

How do I configure custom DKIM for a marketing platform?

Turn on the platform's custom-domain (or "branded sending") option, publish the DKIM record it provides under your own domain — typically a CNAME pointing at a key the provider manages — and let it sign with a selector on your domain. After that, header.d reads as your domain and the signature aligns.

Why does my DMARC report show DKIM failing alignment even though SPF aligns?

DMARC passes if either SPF or DKIM aligns, so your mail may still be delivered on SPF alone. But you lose DKIM's resilience — SPF breaks on forwarding while a DKIM signature usually survives it — so aligning DKIM too is worth fixing rather than leaving it to SPF.

Does fixing alignment improve deliverability?

Indirectly, yes. Consistent DKIM alignment strengthens your DMARC results, and domains that authenticate cleanly earn better inbox placement over time. It also means you can safely move DMARC to enforcement, which is what actually blocks spoofing of your domain.

Why does my DKIM signature fail alignment and how can I fix it?

Seeing a "DKIM alignment failed" line in your email authentication reports feels like a vague rejection note — you know something is wrong, but not what. The confusing part is that your DKIM signatures can be perfectly valid and still fail alignment. This guide explains the difference and walks through each common cause and its fix.

What does DKIM alignment actually mean?

DKIM alignment checks whether the domain in the visible From: header matches the domain that produced the signature — the d= value in the DKIM-Signature: header. When the two match, the signature is "aligned." When they differ, DMARC treats the signature as untrusted for your domain, because a valid signature for a domain an attacker controls could otherwise be used to vouch for mail from yours.

Think of it like a passport at a border: the passport can be genuine, but if the name on it doesn't match the name on your ticket, you're held up.

DKIM alignment vs. DKIM verification

These are two separate checks, and it's the gap between them that trips people up:

DKIM verification confirms the signature itself is cryptographically valid and the message wasn't altered in transit.
DKIM alignment then confirms the signing (d=) domain matches the From: domain.

A signature can pass verification and still fail alignment. Verification is about integrity; alignment is about identity. DMARC needs both. Side-by-side comparison of what DKIM verification checks versus what DKIM alignment checks.

Side-by-side comparison of what DKIM verification checks versus what DKIM alignment checks.

A signature can pass verification and still fail alignment — both checks are needed for full trust.

Common reasons for alignment failures

Third-party email services — Marketing platforms and other tools often sign with their own domain by default (d=sendingplatform.com), which never aligns with your brand domain. This is the single most common cause.
Subdomain mismatches — Relaxed alignment lets a subdomain (mail.example.com) align with its parent (example.com), but only in that direction, and strict alignment requires an exact match.
Configuration errors — Typos in DNS, the wrong selector, or a key-rotation slip can produce valid signatures that don't line up.
Organizational changes — Mergers, rebrands, and fragmented mail infrastructure leave legacy DKIM keys signing under old domains.
Forwarding and mailing lists — Forwarders and lists can modify a message or re-sign it, breaking the original alignment.

For a wider list of ways DKIM breaks, see the top reasons DKIM fails.

How to verify whether DKIM is aligned

DMARC aggregate reports

With any DMARC policy in place — even p=none — receivers send XML aggregate reports that record DKIM alignment status per source. They're machine-readable, so a tool that parses them into a dashboard saves you reading raw XML. Palisade's Email Security Score gives you that view, and how to understand DMARC reports explains what the fields mean.

Inspecting email headers

Send a test message to yourself, open the full headers, and find the Authentication-Results: line. Compare the header.from domain with the DKIM header.d value (the signing domain). If they don't match, the signature isn't aligned — even if the same line says dkim=pass, which only reports verification.

Four steps for checking DKIM alignment by inspecting a test email's headers.

A header.from vs. header.d mismatch indicates DKIM alignment failure.

Quick testing utilities

DKIM checker — confirms your published key and selector resolve correctly in DNS.
Email Security Score — a free snapshot of your domain's SPF, DKIM, and DMARC posture, with alignment gaps flagged.

How to fix DKIM alignment

Resolving alignment almost always comes down to making every sending service sign under a selector on your own domain rather than the provider's:

Identify the misaligned source in your aggregate reports — it's the one where header.d isn't your domain.
In that platform's settings, enable custom domain authentication (sometimes called "branded sending" or "custom DKIM").
Publish the DKIM record the platform gives you under your domain, usually as a CNAME the provider hosts and rotates for you.
Re-send a test and confirm header.d is now your domain and the report shows DKIM aligned.
Enable strict alignment only where you need an exact-domain match; otherwise relaxed alignment (the default) covers subdomains and is easier to keep passing.

Palisade automates the discovery step — its continuous monitoring surfaces the exact services where header.d doesn't match your domain, so you're fixing named sources instead of hunting through XML. When you're ready to tighten policy, the guide to enforcing DMARC covers the safe rollout.

By aligning DKIM correctly you improve deliverability and strengthen the DMARC shield that protects your brand from spoofing and phishing. Check your alignment now for a free snapshot.