Resolving DKIM Signature Alignment Failures

What is DKIM Alignment?

DKIM (DomainKeys Identified Mail) uses cryptographic key pairs to sign outbound messages. However, just having a valid DKIM signature is only half the battle. To pass DMARC checks, the signing domain (d= domain in email headers) must align with the domain in the 'From' header.

Why Aligned Signatures Fail

Many bulk senders use third-party tools like Mailchimp or HubSpot. While these platforms sign outbound emails with their own internal DKIM keys (e.g. d=mcsv.net), this does not align with your sending domain (e.g. d=yourbrand.com). Consequently, email filters flag this as an alignment misalignment.

How to Repair DKIM Alignment

1. Log in to your email delivery platform (e.g. SendGrid, HubSpot, or Mailchimp).
2. Navigate to the Domain Authentication settings and request custom domain keys.
3. Copy the generated CNAME selector records (usually two records, e.g. s1._domainkey.yourdomain.com pointing to dkim.sendgrid.net).
4. Add these CNAME records to your DNS provider. This authorizes the third-party server to sign with your root domain.

Once set up, run a live scan on InboxFixer to verify that your DKIM alignment shows as passing.