What to do when you receive an alignment regression alert

An alignment regression alert fires when your DMARC alignment rate drops significantly from the previous period. This usually means one of three things: a sending service had a configuration change, a new sender started sending as your domain, or your email volume shifted in a way that changes the ratio of passing to failing mail.

Understand what the alert is measuring

The alignment rate is the percentage of messages that passed DMARC alignment out of all messages reported. A regression alert fires when this rate drops by a threshold amount. A drop from 99% to 97% on high volume is very different from a drop from 97% to 60%.

Before investigating, check:

• How large is the drop? A 1-2 percentage point drop on high volume is often noise. A 10+ percentage point drop warrants investigation.
• How many total messages are affected? If your total reported message count is low, a small number of failures can produce a large percentage drop.
• Is the drop sustained or a single day? A one-day spike in failures often indicates a transient event (a test send, a misconfigured batch). A multi-day trend is a more serious signal.

Identify which source changed

Your DMARCdrift report breakdown shows alignment results by source IP. Look for:

• A source that was passing and now appears with failures: this is the most common cause of a regression alert
• A new source that wasn't present before: a new tool, integration, or unauthorized sender added to the mix
• An existing source with dramatically changed volume: more traffic from a failing source can reduce the overall rate even if the source itself hasn't changed

Compare the current period to the previous period. The source responsible for the regression should stand out.

Diagnose the source

Once you identify the source IP, look up the service it belongs to and investigate what changed.

DKIM key rotation without DNS update: Some services rotate DKIM keys periodically. If they generate a new key but the old DNS record wasn't replaced, or the new record wasn't published, DKIM will start failing. Check the service's DKIM settings panel and verify the DNS record matches the current key.

DNS record accidentally modified or deleted: If someone edited DNS records for your domain, they may have accidentally removed or changed a DKIM or SPF record. Check your DNS provider's audit log or change history if available. Use the DKIM check tool or DMARC check tool to verify the records are still correct.

Service migrated sending infrastructure: ESPs occasionally migrate their sending infrastructure, IP ranges, or signing configuration. If the service changed from signing with your domain to signing with their own domain, alignment will fail. Check the service's changelog or contact their support.

New subdomain sender without DKIM: If mail started going out from a new subdomain (for example, alerts.yourdomain.com) without DKIM configured for that subdomain, those messages will fail alignment. Check your DMARC record's sp= tag — if it's set to none, subdomain mail won't be enforced, but failures still appear in reports.

Decide when to act

Not every alignment regression requires immediate action. Consider:

• Is the failing source legitimate? If it's a service you own that had a configuration issue, fix the configuration.
• Is the failing source unauthorized? If it's traffic you don't recognize and can't attribute to a known service, treat it as potential spoofing. Review the unknown sender guide for next steps.
• Is the drop significant enough to affect enforcement plans? If you're planning to move from p=none to enforcement, a regression is a reason to pause until you identify and fix the cause.

For a temporary regression you understand (a test send, a brief configuration issue that's already corrected), acknowledge the alert and monitor the next period to confirm the rate recovered.

---

See also: DMARC alignment failures: symptom-by-symptom diagnosis for failing sources. Unknown sender investigation: when a new source appears that you don't recognize.