SPF pass and SPF alignment answer different questions
SPF checks whether the connecting server is authorized to send for the envelope-from domain, which usually appears as the return path. DMARC alignment compares that authenticated domain with the domain in the visible From address. A message can therefore show `spf=pass` for an ESP-owned bounce domain while SPF contributes nothing to DMARC for your brand domain.
This distinction is easiest to see in delivered headers. Find the SPF result and the domain it evaluated, then compare that domain with the visible From domain. Do not stop at a DNS lookup that says your SPF record is valid; it may not be the record the production message used.
Relaxed and strict alignment
Relaxed alignment accepts domains that share the same organizational domain. For example, a return path under `bounce.example.com` can align with a From address at `example.com`. Strict alignment requires an exact match and is less forgiving of normal provider subdomains. The DMARC record's `aspf` tag controls this choice; relaxed is the default.
Strict mode can be appropriate in a carefully controlled environment, but it should be a deliberate security decision rather than a checkbox. Inventory every sending platform first. Marketing, support, billing, and product mail often use different return paths, and one forgotten system can fail after policy enforcement changes.
Why third-party senders fail alignment
Many ESPs use their own domain for bounces by default. SPF passes because that provider authorizes its servers, but the domain does not align with the brand in the From header. Configure the platform's branded return path, custom bounce domain, or equivalent feature. It normally asks you to publish CNAME or other DNS records under a subdomain you own.
Do not add the ESP to your visible domain's SPF record and assume that alone changes the return path. The provider must actually use the aligned domain when it sends. Verify the next delivered message. If aligned DKIM already passes, DMARC can pass without aligned SPF, but fixing both paths gives clearer identity and resilience.
Forwarding and SPF limitations
Forwarding commonly breaks SPF because the forwarding server connects to the destination but is not listed in the original envelope-from domain's SPF record. Sender Rewriting Scheme can help some forwarding systems, but the rewritten domain may not align with the original visible From address. A surviving aligned DKIM signature is often the path by which forwarded mail passes DMARC.
That is one reason not to build a DMARC strategy around SPF alone. Use aligned DKIM for third-party and forwarded flows where possible. When diagnosing a forwarded copy, compare it with a direct delivery before changing DNS; the forwarder may be the variable.
A clean remediation and retest
Send one production-like message and record the From domain, return path, connecting IP, SPF result, and DMARC result. Configure the provider's branded bounce domain. Wait for DNS to resolve, then send through the same platform again. The pass condition is not merely a visible DNS record—it is `spf=pass` for a domain that aligns with the visible From address.
After authentication is fixed, compare placement with the prior test. Better alignment removes one source of distrust, but it does not erase complaint history, poor list quality, risky links, or a sudden volume jump. Treat a remaining spam result as the next branch of the diagnosis, not proof that SPF was irrelevant.
Questions readers ask
Does SPF have to align for DMARC to pass?
No. DMARC passes when either aligned SPF or aligned DKIM passes. Many teams configure both so one path is not carrying the whole result.
Is the return path visible to recipients?
Usually not in the normal message view, but it appears in headers and delivery reports and is the identity SPF evaluates.
Does adding an ESP include to SPF create alignment?
Not by itself. The sent message must use an aligned envelope-from domain. Configure and verify the provider's branded return path.