Case study · Trust

DKIM Alignment Under a DMARC Quarantine Policy

Corporate domains had SPF and DMARC published, but third-party senders on those domains were failing authentication and landing in quarantine. The simulator below is the tool built to make that gap legible to IT, DevOps, and leadership: it parses a real SPF record token by token, evaluates alignment for both authenticators, and traces the delivery verdict back to its cause.

Context

  • DMARC passes if either SPF or DKIM authenticates and aligns with the visible From domain.
  • Third-party senders that manage bounces through their own Return-Path break SPF alignment by design, so DKIM signed with the organization’s own domain is usually the only path to a pass.
  • Until a signing key was configured and published for each sender, every message on that path evaluated as 0 of 2 aligned and was quarantined under p=quarantine.
  • Try it: pick a sending service, toggle DKIM between service default and your domain, and watch the verdict flip. Hover any trace line for the underlying header values.

Outcome

With DKIM signing aligned, the same sending paths moved from quarantine to inbox with no change to the DMARC policy itself. The broader effort corrected SPF and DMARC records across company property domains in coordination with IT and DevOps, moving sender identity from a published policy to an enforced one.

Source for the simulator component is in src/DmarcSimulator.jsx alongside this page.