Reading a failing DKIM with a passing SPF-aligned DMARC

Email authentication can look contradictory on the surface: a message might arrive with a broken DKIM signature, yet still pass DMARC because the SPF check aligned with the visible From address. For Australians reviewing mail logs, whether in a small business in Brisbane or a security team at a Sydney-based enterprise, this mixed result is worth decoding carefully. It does not mean the email is fraudulent, but it does reveal something concrete about how the sender's infrastructure is configured and where the weak links sit.

Three protocols work together to validate a sender: SPF confirms the sending IP is authorised by the domain's DNS record, DKIM adds a cryptographic signature that travels with the message, and DMARC ties both checks back to the visible From header. DMARC only requires that one of those two mechanisms, SPF or DKIM, passes and aligns with the From domain. The message can therefore be delivered even when DKIM is broken, as long as the SPF result lines up.

How SPF, DKIM, and DMARC work together

SPF is published as a DNS TXT record listing the IP addresses and hostnames permitted to send mail on behalf of a domain. When an email is received, the receiving server checks the envelope sender, known as the MAIL FROM or Return-Path, against that list. A pass means the sending server was explicitly authorised. SPF alone, however, only authenticates the envelope, not the visible From address that recipients see in their inbox.

DKIM closes that gap by adding a digital signature to specific headers and the body of the message. The signature is verified using a public key published in DNS. If even one byte of the signed content changes during transit, verification fails. DKIM therefore proves both that the message came from a holder of the private key and that it was not modified in transit.

DMARC binds the two checks together by requiring that at least one of them, SPF or DKIM, aligns with the domain shown in the From header, and by instructing receivers how to handle failures. Alignment means the domain in the authenticated identifier matches the domain the recipient sees, either exactly or as an organisational parent.

Why DMARC still passes without a valid signature

DMARC was deliberately designed with flexibility, recognising that many organisations rely on multiple sending paths, third-party platforms, or legacy forwarding setups. The alignment requirement checks whether the domain in the authenticated identifier matches the domain in the From header. If SPF passes and the sending envelope domain matches the visible From domain, alignment is achieved regardless of whether DKIM verifies.

This is why an Australian retailer using a marketing automation platform or a transactional email service might see DKIM fail for some messages but still sail through DMARC checks at the recipient's gateway. The mail is being routed through an IP address the sender has authorised, and that IP's envelope domain matches the visible sender. The cryptographic layer is missing or broken, but the authorisation chain based on routing remains intact.

The receiving server reports this honestly in its Authentication-Results header. It will show dkim=fail alongside spf=pass and dmarc=pass, leaving the operator to interpret what that combination actually means.

What a failing DKIM specifically reveals

A DKIM failure is never trivial. It points to a configuration problem upstream of the mail server, such as a stale DNS TXT record after a platform migration, a missing public key, or a body or header modification in transit that invalidated the signature. It could also indicate that the message was sent through a path the sender did not sign, for example, a forwarded copy or a third-party service the organisation never added to its DKIM signing list.

Australian domain owners operating under the .au namespace rules administered by auDA need to be especially careful here, as their reputation depends on consistent authentication across every sending source. A DKIM record that points to an old key from a previous ESP, for instance, will silently fail every new message until it is updated.

If the failure is persistent across many messages from the same sender, it often signals that the team has not finished configuring DKIM for all outbound channels. A single broken DKIM signature does not break delivery, but it removes a layer of integrity that protects against in-transit tampering and impersonation. The email is authenticated by routing alone, which is weaker than authentication by signature.

Implications for the sender's trust profile

The combination of a passing SPF alignment and a failing DKIM signature tells you that the sender's credentials are partially intact. The domain owner has clearly invested in publishing an SPF record and a DMARC policy, which is a step ahead of the many Australian small businesses that still send mail without any authentication at all.

However, the absence of a working DKIM signature means the sender has not completed the full suite of protections recommended by the Australian Cyber Security Centre. From a reputation standpoint, the domain may receive a neutral or unrated trust score from lookup tools, because the signals are mixed.

Mailbox providers treat this state with caution: some deliver normally, others throttle the sender or flag the message for additional scrutiny. Recipients should not assume the email is malicious simply because DKIM is broken, but they also should not treat it as fully authenticated. Useful background on why scores end up in this middle ground is covered in explaining neutral trust scores.

Practical steps for recipients and senders

Recipients can dig into the authentication details by viewing the full email headers, looking for the DKIM signature result, the SPF result, and the DMARC verdict reported by the receiving server. If DKIM is reported as fail but DMARC is pass, note the sending service. Often the cause is a known forwarding chain, a mailing list, or a sending platform that the sender forgot to sign with DKIM.

Senders, meanwhile, should treat a recurring DKIM failure as a priority fix. Rotate or republish the DKIM TXT record if the public key has changed, ensure every sending platform signs outgoing mail, and run regular checks against a verification platform.

For organisations that want a quick way to confirm whether their setup is producing mixed signals, running a domain through Trusted Sender Score surfaces SPF, DKIM, and DMARC status in a single view, alongside reputation indicators that help triage whether the partial alignment is masking a deeper issue.