DKIM pass but DMARC fail? Fix the alignment, step by step

Read the header first

Open the message's full headers (in Gmail: the three-dot menu, then Show original) and find the Authentication-Results line. A typical failing one looks like this (domains are examples):

Authentication-Results: mx.receiver.example;
  dkim=pass header.i=@sendingtool.example header.s=s1 header.b=AbC123;
  spf=pass smtp.mailfrom=bounces.sendingtool.example;
  dmarc=fail (p=QUARANTINE) header.from=example.com

Put three domains side by side:

From (header.from): example.com. This is the domain people see, and the one DMARC protects.
DKIM signing domain (header.i or header.d, the d= tag of the signature): sendingtool.example.
SPF domain (smtp.mailfrom, the Return-Path): bounces.sendingtool.example.

Both checks passed, but each for the sending tool's own domain. DMARC passes only when SPF or DKIM passes for a domain that matches the From domain. That match is called alignment. Here neither aligns, so DMARC fails.

What "matches" means

Relaxed (the default, adkim=r): the signing domain and the From domain share the same organisational domain. mail.example.com aligns with example.com.
Strict (adkim=s in your DMARC record): they must be identical. mail.example.com does not align with example.com.
A different domain you also own (example.net, or an old brand name) never aligns with example.com, whatever the mode.

The three usual causes, and their fixes

1. The tool signs with its own domain

The most common case: a newsletter, CRM, store or help-desk tool sends as you but signs with its shared domain, as in the header above. Fix: in that tool, find the domain authentication setting (often called "domain authentication", "custom DKIM", "branded sending" or "verify your domain"). It gives you one to three DNS records, usually CNAMEs named like s1._domainkey.example.com. Publish them exactly as given, then click verify in the tool. New mail is then signed with d=example.com, and DMARC passes on DKIM alone.

2. Strict mode with a subdomain signer

The header shows header.d=mail.example.com, From is example.com, and your DMARC record has adkim=s. Fix: unless you chose strict mode for a specific reason, remove adkim=s (relaxed is the default). Otherwise configure the tool to sign with exactly the From domain.

3. Signed with a different domain you own

Mail sent "From" example.com but signed for example.net, often after a rebrand or because the tool was set up under the old domain. Fix: authenticate the From domain in the tool as in cause 1, or send from the domain that's already authenticated.

Why not fix it with SPF instead?

You could make SPF align by giving the tool a custom Return-Path (bounce) domain under yours, and some tools offer that too. Do DKIM first anyway: an aligned DKIM signature survives forwarding, while SPF breaks whenever a message is forwarded. Adding the tool's include: to your root SPF record usually does not help here, because SPF is checked against the Return-Path domain, which in the header above is the tool's own.

Check the fix

Run the checker above with the selector the tool gave you (for s1._domainkey, the selector is s1). It should find a valid key.
Send yourself a test from the tool and read the header again. You want dkim=pass header.d=example.com (or a subdomain, in relaxed mode) and dmarc=pass.
If you receive DMARC reports, that source should show DKIM pass in policy_evaluated within a day or two. How to read a report row.

Quick reference

DMARC needs one pass that aligns with the From domain: DKIM d= or the SPF Return-Path domain.
dkim=pass for someone else's domain counts for nothing in DMARC.
Fix: authenticate your domain inside each sending tool (DKIM CNAMEs), then confirm header.d in a test message.
Strict adkim=s rejects subdomain signers; relaxed is the default.

DKIM pass, DMARC fail: fixing alignment