> On 27 Aug 2026, at 09:26, Benoit Panizzon via mailop <[email protected]> > wrote: > […snip...] > Now one of our customers configured a _DMARC entry for his From: domain > - emails to his customers now get rejected because of 'SPF alignment > fail'. > > To my understanding, no matter what aspf and adkim flag used, this > causes a DMARC aware receiving server to require the envelope sender > domain and from domain to be aligned (aka both being in the same > domain). > > How would you solve this situation?
I would DKIM sign the outgoing message with the From domain, i.e. example.com. DMARC works on either SPF or DKIM being aligned and passing. If you have non-aligned return-path domain then you need to DKIM sign with the From domain. A potentially cleaner alternative would be get your client to delegate a sub-domain (e.g. voicemail.example.com) via CNAME or NS exclusively for use with your service and automatically generate the DKIM there. Ken. _______________________________________________ mailop mailing list [email protected] https://list.mailop.org/listinfo/mailop
