DKIM alignment vs a passing signature

A passing DKIM signature means the cryptographic check on the message succeeded. DKIM alignment means the domain in the signature’s d= tag matches the domain in your From: header, under relaxed or strict rules. DMARC needs that match. A vendor signature that passes on mail showing your From: address is still useful cryptography, but it does not count for DMARC on its own.

When a pass still fails DMARC

Many ESPs sign with something like d=mail.esp.example while your From: address uses example.com. The signature verifies cleanly, so you see dkim=pass. DMARC still ignores that result because the domains do not align. SPF can rescue the message if the envelope domain aligns, but you should not rely on that path alone.

The usual fix is to sign under your own domain. The ESP publishes a CNAME (or similar) for a selector on example.com, so the effective d= becomes example.com and matches From:. On this server, cPanel mail signed as default._domainkey.example.com with From: on example.com is already the aligned case. That is what you want for mail that leaves LogicWeb.

Relaxed versus strict alignment

Relaxed DKIM alignment allows d=mail.example.com to align with From: example.com. Strict alignment requires an exact match as your DMARC policy defines it; adkim=s turns strict on. Prefer relaxed unless you have a clear reason to tighten the rule. Most domains never need strict mode.

Strict mode is how a working subdomain signer starts failing DMARC after a small From: change. SPF has the same knob with aspf=, and the same advice applies. If you omit the tag, the specification treats the mode as relaxed.

Getting alignment and keeping selectors clear

Do not chase a second vendor signature only because the first one passed and mail still lands in quarantine. You already have a cryptographic pass; you are missing alignment. Do not disable DKIM on the ESP only because cPanel also signs. Two aligned signatures are fine. One unaligned pass plus hope is not.

After you change selectors, send a test message and read the headers. You want dkim=pass and a d= that matches From: under the alignment mode you published. Then DMARC has a result it can use. If both an ESP and this server send as the same domain, give them different selectors. cPanel’s default and an ESP’s s1 can live side by side. Sharing the name default is how one side overwrites the TXT record and the other side fails overnight.