Put the two domains side by side

Extract the domain from the single RFC 5322 From address; this is the DMARC Author Domain. Then read the SPF-authenticated identifier reported by the trusted receiver, normally based on the SMTP MailFrom identity. Do not substitute Reply-To, display name, or a website URL.

An illustrative result is:

From: Billing <receipts@example.com>
Authentication-Results: receiver.example;
  spf=pass smtp.mailfrom=bounces@provider.example;
  dmarc=fail header.from=example.com

SPF passed for provider.example. That domain is not identical to example.com, and in this example it is not in the same organizational-domain relationship, so it is not aligned. The two results are compatible, not contradictory.

Evaluate the published mode

DMARC’s aspf tag selects relaxed or strict SPF alignment; relaxed is the default. Strict compares for exact identity. Relaxed uses organizational-domain determination under current RFC 9989 tree-walk rules. Use a current evaluator and DNS evidence rather than relying on an outdated public-suffix-only explanation.

Check the DMARC record actually discovered for the Author Domain at the observation time. A subdomain record can affect policy discovery and organizational-domain determination.

Check the DKIM path too

DMARC passes when at least one supported path has both authentication pass and alignment. A passing aligned DKIM signature can satisfy DMARC even when SPF is unaligned. Inventory every DKIM signature and identify its d= domain and result.

If neither path aligns, choose an owned correction. A provider-supported custom return-path can align SPF while retaining proper bounce handling. A provider-supported DKIM signature using an owned domain can align DKIM. Do not fake alignment by routing bounces to an unmanaged address or copying provider records without account verification.

Retest the complete stream

After configuration and DNS changes, send a new message from the affected application. Record the trusted SPF identity/result, DKIM domains/results, Author Domain, and DMARC result. Repeat for other templates or regions that use separate provider settings.

The diagnosis is complete when it states which authenticated identifier failed to align and which verified path now satisfies DMARC. “SPF is green” is not enough detail for that conclusion.