DKIM Domain Alignment Failures

An RFC 5322 alignment error occurs when the domain in the “From:” header (visible to users) doesn’t match the DKIM d= domain (in the signature). DMARC requires that the domain in the “From:” header aligns with the domain authenticated by either SPF or DKIM.

What is RFC 5322? 

RFC 5322 defines the syntax for Internet email headers, including the “From:” header. DKIM and DMARC rely on these headers for authentication. SPF, on the other hand, checks the envelope sender (MAIL FROM) as per RFC 5321. RFC 5322 was published in October 2008, and it is now a standard for formatting email headers and bodies. 

If there were no alignment requirements, attackers could have simply used valid SPF or DKIM records from one domain while spoofing the “From:” address of another. With the alignment requirement in place, the job of the hackers becomes much more challenging: if the domains do not align, DMARC authentication will fail, and the email will either be sent to spam or get rejected outright. 

Why DKIM and RFC 5322 Alignment Matters

The main aim of the DKIM and RFC 5322 alignment requirement is to prevent unauthorized access. 

Core Issue: DMARC’s Alignment Requirement

DMARC requires that the domain in the email’s “From:” header to at least partially align with the domain specified in the DKIM signature’s “d=” field. In strict alignment, the domains must match exactly. In relaxed alignment, they should at least share the same organizational domain.

Common Mismatch Scenarios

Here are some of the most common mismatch scenarios: 

Use of Marketing Tools

Marketing tools often send emails from addresses such as [email protected] but sign them with a DKIM “d=example.com” domain. In such a situation, if DKIM alignment is set to strict alignment (adkim=s) it is likely that you will see the DKIM signature alignment fail.

Email Forwarding 

While forwarding usually affects SPF more than DKIM, DKIM can also fail during forwarding, but only if the message is modified (e.g., by mailing lists). Note that the “From:” header is rarely changed by forwarders.

Here is an example of misalignment:

• From: [email protected] (RFC 5322 header)
• DKIM-Signature: d=example.com (misaligned domain and DMARC fails)

Common Causes of Alignment Issues

Some of the most common causes of alignment failures include: 

Third-Party Service Usage

When you send emails via third-party external providers that do not properly configure domain alignment, you are likely to experience DKIM domain RFC 5322 alignment failure. 

DKIM Record Misconfiguration

When your DKIM records or selectors are set up incorrectly, a misalignment is likely to occur. Even a minor error in the setup can lead to major failures impacting your email deliverability. 

Domain Inconsistencies

When you use different domains in the DKIM signature and the “From:” header, it should be no surprise to experience an RFC 5322 From header mismatch. Whether the domain inconsistency is due to an oversight and misconfiguration, or is part of your setup intentionally, in both cases, a mismatch and subsequent problems are quite likely. 

How to Diagnose RFC 5322 Alignment Failures

Here are two quick steps to help you diagnose the RFC 5322 alignment problem.

1. If you want to diagnose RFC 5322 alignment failures, first, carefully review your DMARC reports for entries with the reason “dkim alignment failed.” 
2. Next, you can use email authentication tools such as a DKIM checker or the dig command to verify your DNS records. This will help you confirm that DKIM signatures are properly published and match your sending domain. 

How to Fix DKIM-RFC 5322 Misalignment

Here are some easy-to-implement steps to fix the DKIM-RFC 5322 misalignment. 

1. Match DKIM and From Domains

Always ensure the DKIM signature uses the same domain as the “From:” header. This is best for emails sent directly from your domain.

2. Set Alignment Mode

Ensure you set the alignment mode that best suits your preferences and needs. Use adkim=s for strict alignment (when exact match required) or adkim=r for relaxed alignment (to also allow subdomains) in your DMARC policy.

3. Add Subdomain DKIM Keys

If you use subdomains in your ‘From:’ address, ensure DKIM is configured to sign messages using that exact subdomain or adjust your DMARC alignment mode accordingly.

4. Preserve the Initial “From:” Header 

You should configure your email services to preserve the original “From:” domain in the message header. There may be times during email forwarding when intermediaries may unintentionally modify the “From:” header or other parts of the message, potentially breaking DKIM alignment and causing DMARC failures. Maintaining the original “From:” header helps preserve domain alignment, and when combined with ARC (Authenticated Received Chain), it can provide additional authentication context to help the recipient server evaluate the message’s legitimacy despite intermediary changes.

5. Test and Validate

Testing and validating is an often overlooked yet key step in the process. There are many freely accessible tools that you can use to check domain alignment and DKIM setup. Using such tools will help you ensure that DMARC authentication passes and your message is delivered to the intended recipient.