Rejected because of DKIM check fail; alignment check fail

Question

I am testing my mail server setup with this tool https://email-test.had.dnsops.gov/ and I am getting suspicious that the tool may not be working right.

From what I understand it reports that my alignment check fails. I do not understand what is failing, because other online test tools state:

• SPF: pass
• DKIM: pass
• DMARC: pass

This is the resulting report I get from the tool: (Note, the email address they provide in the report is not the one I used to generate the test. Somehow they got that wrong too.)

This email contains the results of the email sent to the "[email protected]" test tool. The test tool tries to obtain and validate SPF and DKIM on the sent message.

The results are summarized below:

SPF result: pass: pass: SPF found and SPF check for the sender at [my-IP-Address] passed.

DKIM result: pass: DKIM key with selector "[my-selector]" found and successfully validated DKIM signature.

DMARC result: DMARC RR found for sending domain.

Ultimate disposition based on above: Rejected because of DKIM check fail; alignment check fail.

What do I need to do in order to align what is not aligned. It makes no sens.

Answer 1

That's referring to DMARC Alignment. For DMARC to pass, you need either authorization via SPF on an aligned domain or else a valid signature via DKIM on an aligned domain.

Unless you've specified strict alignment (adkim:s or aspf:s), you're using the default relaxed mode for alignment, which means the organizational domain (aka paid-level domain, the thing you registered, residing right under the public suffix, like "foo.co.uk" rather than "mail.foo.co.uk"). If you are using strict alignment, the whole hostname (FQDN) must match to be aligned.

The domain used in your From header must be aligned with the domain used by DKIM (the d= value in the DKIM-Signature header) or with the domain used by SPF (the SMTP mail from command or the SMTP helo or ehlo name).

If you're sending with a header of From: MeSo2 <[email protected]> but the DKIM-Signature contains d=meso2.provider.net, DKIM is not aligned (example.com ≠ provider.net). If you also passed SPF but your SMTP conversation identified your host with ehlo smtp.meso2.com and sent the message as mail from:<[email protected]>, SPF is not aligned (example.com ≠ meso2.com, example.com ≠ so2.com).