SendGrid, Mailchimp & co failing DMARC? Fix third-party sender alignment

Your newsletter tool swears authentication is configured, the headers even say spf=pass and dkim=pass — and DMARC still fails. That's not a bug. It's an alignment problem, and every third-party platform has the same fix.

Check your domain's DMARC setup — free, no signup

Why platforms fail DMARC by default

When SendGrid, Mailchimp, HubSpot, or any other platform sends "as you" out of the box, two things are true:

• The Return-Path (the hidden bounce address SPF checks) is the platform's domain — something like bounces.sendgrid.net — so SPF passes for them.
• The DKIM signature is the platform's shared key — d=mailchimpapp.net, d=sendgrid.net — so DKIM passes for them.

DMARC ignores both, because neither domain matches the From: address your recipients see. To pass DMARC, SPF or DKIM has to pass for your domain. That matching rule is called alignment — the full background is in SPF vs DKIM vs DMARC, and the other failure causes in why DMARC fails.

The fix is the same everywhere, just named differently: find the platform's "domain authentication" (also sold as "custom DKIM", "sending domain", or "email authentication") and publish the DNS records it generates. That makes the platform sign with your domain and usually gives you an aligned custom Return-Path too.

Where the setting lives, platform by platform

The exact DNS records are generated per account — always copy them from the platform's screen, not from a blog post. Where to find that screen:

SendGrid

Settings > Sender Authentication > Authenticate Your Domain. SendGrid generates a set of CNAME records (a custom Return-Path host plus two DKIM selector hosts on your domain, pointing at SendGrid). Publish all of them and verify. After that, mail signs as your domain and the Return-Path aligns — both SPF and DKIM count for DMARC.

Mailchimp

Website > Domains > Start Authentication (after verifying the domain). Mailchimp gives you CNAME records for its DKIM selectors on your domain. Since the 2024 Gmail/Yahoo bulk-sender rules, Mailchimp effectively requires this for sending from a custom domain — if you skipped it back then, your campaigns are the unaligned source in your reports.

HubSpot

Settings > Content > Domains & URLs > Connect a domain > Email sending. HubSpot walks you through publishing DKIM CNAME records for your domain.

Anything else

Search the platform's docs for "DKIM" or "domain authentication". If a platform genuinely cannot sign with your domain, it cannot align — mail it sends from your address will fail DMARC forever. Either move that mail to a subdomain with its own policy, or replace the platform before you tighten to p=reject.

How to verify it worked

1. Send yourself a message from the platform to a Gmail address and open Show original.
2. Check dkim=pass with header.d=yourdomain.com — your domain, not the platform's.
3. Check the top line says dmarc=pass.

Then confirm at scale: your DMARC aggregate reports will show the platform's sending IPs moving from the failing column to passing-aligned within a day or two. If you're not getting reports at all, fix that first — not receiving DMARC reports.

Two traps to avoid

• Stuffing every platform into SPF and calling it done. Adding include: entries authorizes the platform's servers but does nothing for alignment when the Return-Path is still the platform's domain — and each include burns DNS lookups toward the 10-lookup limit. Custom DKIM is the fix; SPF includes are a supplement.
• Tightening policy before every platform is aligned. Moving to p=quarantine or p=reject while your invoicing tool still signs as itself sends your own invoices to spam. Confirm every legitimate source passes aligned in your reports first — the rollout order is covered in p=none vs quarantine vs reject.