PayFlowFix.dev
guide · dmarc alignment

DMARC alignment, and why SPF passing is not enough

DMARC does not care that SPF passed. It cares that the domain SPF passed for matches the domain in the From header your recipient sees. That mismatch is the most common invisible DMARC failure.

What this actually means

This is the common pattern we see when dmarc alignment comes up in search.

Run the free checker on your domain to see your own numbers. The checker shows the full SPF include chain, the exact lookup count, and which selector actually exists for DKIM.

Why it matters for payment flows

Customers who pay successfully but never get a receipt, invoice or status update assume the payment failed. Support tickets follow, refunds are requested, and the engineering team spends hours debugging a webhook that never had a chance to be read.

What to do next

  1. Check the domain with the free tool.
  2. Fix the mechanical issue first — lookup limit, missing DKIM, absent DMARC. Those are checkable in under a minute.
  3. If email authentication is clean and the customer still sees nothing, the fault is downstream: a webhook that failed signature verification, an event type you never subscribed to, or a status that never synced.

Sources and standards

  • RFC 7208 SPF, RFC 7489 DMARC, RFC 6376 DKIM — the actual specifications, not a blog summary.
  • Lookup counts measured live with the engine in this repo, https://payflowfix.dev.

FAQ

DMARC alignment: why SPF passes but DMARC still fails
DMARC does not care that SPF passed. It cares that the domain SPF passed for matches the domain in the From header your recipient sees. That mismatch is the most common invisible DMARC failure.
Where does this fit in a payment flow?
Email authentication is upstream of whether a customer ever sees a receipt. If SPF, DKIM or DMARC is broken, the receipt, invoice or password reset lands in spam or is rejected. That looks like a payment integration failure, but it is DNS.
Can I check this myself?
Yes — the free checker expands your whole SPF chain and counts lookups the way a receiver does. Paste your domain and you get a copy-ready record.
Do you log my domain?
No. The checker runs in your browser against Cloudflare and Google DNS-over-HTTPS. This site is static; there is no backend.

Still broken after the DNS is right?

Email authentication is DNS. Payment notifications not arriving is usually not — it is a webhook that failed signature verification, an event type you never subscribed to, or a status that never synced. That is what I fix: a fixed-fee $99 root-cause diagnosis, credited toward the repair.

Get a $99 diagnosis What I fix