Start with three domains, not three green labels
Imagine a newsletter with From: news@sender-example.test. Its provider reports SPF pass for bounce@mailer-example.test and DKIM pass with d=mailer-example.test. This is a fictional troubleshooting example, not a measurement of a real sender.
Both mechanisms can pass for the provider while neither aligns with the sender’s From domain. DMARC needs a passing, aligned identity.
| Identity | Domain | Aligned with From? |
|---|---|---|
| Visible From | sender-example.test | Reference domain |
| SPF envelope sender | mailer-example.test | No |
| DKIM signing domain | mailer-example.test | No |
Ask the sending platform for domain authentication
Open the domain-authentication settings in the service that sent the newsletter. Look for custom-domain DKIM and, where supported, a custom return-path or bounce domain. Follow that provider’s exact DNS instructions for your account.
Adding the provider to an unrelated SPF record will not change the message’s signing domain. Changing DMARC to p=none also does not make a failing message pass; it changes the requested treatment of failures.
Confirm the change on a fresh message
After the provider confirms the setup and DNS caches have had time to refresh, send a new newsletter test through that same platform. Compare the reported identities with your earlier result. Record what changed, rather than relying on the provider’s setup screen alone.
Repeat this for other sending services. An invoice tool, a website form and your mailbox can each need their own configuration.
Sources
Sources checked on 6 November 2026. Provider guidance can change.