Google, Alignment and DMARC

Google has been making a number of changes to their systems over the last few weeks. Folks are seeing a lot of changes in Google postmaster tools and they’re seeing changes in how Google is displaying headers in the “show original” tab.

One thing that some folks were seeing is a message that says:

A screenshot from "Show Original" at google that says:
<p>SPF: Pass with IP 104.224.223.158
DKIM: 'Pass: with domain wordtothewise.com
Alignment: The From header Laura Atkins <laura@carrotcafe.com> does not match the DKIM domain wordtothewise.com. Be careful with this message as the sender may be spoofing the From header identity. " class=“wp-image-17126” srcset="/2025/03/google-alignment-and-dmarc/image-1.png 1660w, /2025/03/google-alignment-and-dmarc/image-1-300x56.png 300w, /2025/03/google-alignment-and-dmarc/image-1-450x84.png 450w, /2025/03/google-alignment-and-dmarc/image-1-150x28.png 150w, /2025/03/google-alignment-and-dmarc/image-1-768x143.png 768w, /2025/03/google-alignment-and-dmarc/image-1-1536x287.png 1536w, /2025/03/google-alignment-and-dmarc/image-1-720x134.png 720w, /2025/03/google-alignment-and-dmarc/image-1-580x108.png 580w, /2025/03/google-alignment-and-dmarc/image-1-320x60.png 320w" sizes=“auto, (max-width: 1660px) 100vw, 1660px”/></figure></p>
<p>This “Alignment” description replaced the DMARC verdict in the header. The interesting thing here is that while DKIM doesn’t align, SPF does pass and so the message technically passed DMARC. </p>
<p>Mike J. on the emailgeeks slack channel mentioned that he noticed that this only seemed to happen when there wasn’t a DMARC policy published for the domain. Well, I can test that! I have multiple domains that do align with SPF, don’t align with DKIM and don’t have current DMARC policies. </p>
<p>We published a DMARC p=none policy for carrotcafe.com and I repeated the test send. </p>
<figure class=A screenshot from "Show Original" at google that says:
<p>SPF: Pass with IP 104.224.223.158
DKIM: 'Pass: with domain wordtothewise.com
DMARC: 'Pass'" class=“wp-image-17129” srcset="/2025/03/google-alignment-and-dmarc/image-3.png 1686w, /2025/03/google-alignment-and-dmarc/image-3-300x47.png 300w, /2025/03/google-alignment-and-dmarc/image-3-450x70.png 450w, /2025/03/google-alignment-and-dmarc/image-3-150x23.png 150w, /2025/03/google-alignment-and-dmarc/image-3-768x119.png 768w, /2025/03/google-alignment-and-dmarc/image-3-1536x239.png 1536w, /2025/03/google-alignment-and-dmarc/image-3-720x112.png 720w, /2025/03/google-alignment-and-dmarc/image-3-580x90.png 580w, /2025/03/google-alignment-and-dmarc/image-3-320x50.png 320w" sizes=“auto, (max-width: 1686px) 100vw, 1686px”/></figure></p>
<p>So, yeah, that’s pretty definitive. The “alignment” warning pops up when DKIM doesn’t align and when there is no DMARC record published in DNS. If there is a DMARC record published in DNS, then the DMARC results take precedence. </p>
<p>Of course, as a scientist I would be remiss if I didn’t point out what I didn’t test. The conditions I don’t have the ability to test right now are DKIM aligned and passing with no DMARC record. My hypothesis / gut feel is that it would say DMARC pass, but without running the test I can’t say that’s what is happening. </p>
<p>Word of caution, though. These displays and reports do seem to be a bit buggy. Another email geek posted a screenshot that showed DKIM passing and aligned but also with the Alignment warning. In this case the alignment warning said “The From header of @email.example.com does not match DKIM domain email.example.com.” Which is clearly wrong. That message was double DKIM signed, by the customer and by the ESP domain, so it’s possible that there is a bug that needs to be fixed by the developers. </p>
<p>Overall, I think Google is testing how they’re displaying things specifically to the email deliverability space. Most folks don’t look at the “original display” for their emails. I’d even wager the vast majority of folks who do look at this are in deliverability, email, security or some other technology adjacent field. This is something they’re working out how best to show information.</p>
<p>One important thing to remember: the actual headers of these messages show the messages are correctly authenticated. Also, there seem to be no deliverability consequences (yet!) to the lack of alignment. Currently this is a display issue only. I think it does indicate that Google are serious about expecting folks to have DMARC records, even if they’re p=none. I also think it’s telling that they are putting much more value on DKIM passing and they’re ignoring SPF passing in the instance of no DMARC record. </p>
<p>I’ve been saying for more than a year that deliverability is in an era of upheaval and change and I think this is another example of it. We’re not sure what Google is doing, nor what it means. We just need to be a bit patient and keep our eyes open for what’s going on. I do expect it’s going to be a little longer before things settle down. But that’s OK, we’ve done this before, we can do it again.</p>
<p></p>

          </div>
          <div class=

Related Posts

Some Microsoft thoughts

Right at the end of January, Microsoft appears to have made couple of changes to how they’re handling authentication. The interesting piece of this is that, in both cases, Microsoft is taking authentication protocols and using them in ways that are slightly outside the spec, but are logical extensions of the spec.

Read More

Gmail showing authentication results to endusers

A bit of older news, but worth a blog post. Early in August, Gmail announced changes to the inbox on both the web interface and the android client. They will be pushing authentication results into the interface, so end users can see which emails are authenticated.

These are not deliverability changes, the presence or absence of authentication will not affect inbox delivery. And the gmail Gmail support pages clarify that lack of authentication is not a sign that mail is spam.
This isn’t a huge change for most ESPs and most senders. In fact, Gmail has reported more than 95% of their mail is authenticated with either SPF or DKIM. Now, Gmail does a “best guess” SPF – if it looks like an IP should be authorized to send mail for a domain (like the sending IP is the same as the MX) then it’s considered authenticated.
It’s good to see authentication information being passed to the end user.

Read More