SPF fail-unaligned

"SPF fail-unaligned" is not an SMTP reply code or a raw SPF result. It is a DMARC identifier-alignment outcome, surfaced in DMARC aggregate (RUA) reports and inbound provider headers (e.g., dmarc=fail (... spf=pass ...)). It tells you something specific: SPF itself passed, but the domain SPF authenticated is not aligned with the domain your recipients see in the From: header — so SPF cannot contribute a passing result to DMARC.

Spec note: DMARC was originally defined in RFC 7489. As of May 2026, DMARCbis (RFC 9989, and its reporting companions RFC 9990/9991) obsoletes RFC 7489 and moves DMARC onto the Standards Track. The alignment concepts below — the aspf/adkim tags, relaxed vs. strict modes, and v=DMARC1 records — carry over unchanged, so existing records keep working. The main under-the-hood change is that the Organizational Domain is now determined by a DNS "tree walk" rather than the Public Suffix List; it does not change the behavior described here.

What causes "SPF fail-unaligned"?

SPF (RFC 7208) authenticates the RFC 5321.MailFrom identity — the envelope sender, also called the Return-Path or bounce address. DMARC, however, only trusts SPF if that authenticated domain aligns with the RFC 5322.From header domain (the address shown to the recipient). Per RFC 7489 §3.1.2 (carried forward in RFC 9989), alignment comes in two modes:

• Relaxed (aspf=r, the default): the SPF-authenticated domain and the From: domain must share the same Organizational Domain. A subdomain like bounces.example.com aligns with example.com.
• Strict (aspf=s): only an exact DNS match aligns.

You get "SPF fail-unaligned" when SPF passes but the two domains don't satisfy the active mode. The classic trigger is sending through an ESP/relay that stamps its own Return-Path — e.g. SPF passes for bounce.sendgrid.net or amazonses.com, but your From: is you@yourdomain.com. Different organizational domains, so even relaxed alignment fails. A second, narrower trigger: your envelope domain is mail.yourdomain.com, your From: is yourdomain.com, and someone set aspf=s — relaxed would pass, but strict rejects the subdomain.

Note: the original guidance "set the SPF record to relaxed" is inaccurate. Alignment mode is not configured in the SPF record. It is set by the aspf tag in your DMARC record, and it governs DMARC alignment, not whether SPF passes.

How do I fix "SPF fail-unaligned"?

1. Set a custom Return-Path on your own domain (the durable fix). Configure your sending platform to use a bounce/Return-Path domain under your organizational domain so SPF authenticates a domain that aligns with From:. Most providers support this via a CNAME or MX-delegated subdomain:

• Amazon SES: enable a Custom MAIL FROM domain (e.g. mail.yourdomain.com).
• SendGrid / Twilio: complete Domain Authentication (formerly "domain whitelabel"), which sets em. / bounce subdomains under your domain.
• Mailgun: send from a verified sending domain rather than the shared sandbox/mg default.

After setup, the envelope domain becomes a subdomain of your From: domain and passes relaxed alignment automatically.

2. If the mismatch is subdomain-only, relax aspf. When your envelope is already on a subdomain of your From: org domain and the only problem is strict mode, switch DMARC to relaxed:

v=DMARC1; p=reject; aspf=r; adkim=r; rua=mailto:dmarc@yourdomain.com

(aspf=r is the default, so this only matters if you previously set s.)

3. Lean on aligned DKIM as the resilient path. DMARC passes if either SPF or DKIM is passing and aligned (RFC 7489 §4.2; RFC 9989). DKIM alignment survives forwarding and shared Return-Paths far better than SPF. Sign with a DKIM d= domain equal to or a subdomain of your From: domain, and "SPF fail-unaligned" stops mattering for delivery as long as DKIM is aligned.

Verify: read your DMARC aggregate reports or check a test message's Authentication-Results header — you want to see spf=pass and the SPF domain sharing your From: organizational domain (or dkim=pass aligned).

For Courier: when sending email through your own ESP/SMTP provider configured in Courier, complete that provider's domain-authentication/custom-Return-Path step so the envelope domain aligns with your From: address.