# AWS SES - SPF Raw Pass but DMARC Fail-unaligned **URL:** \ **Category:** Technical Help\ **Created:** [October 11, 2021, 5:46pm UTC](https://forum.dmarcian.com/t/aws-ses-spf-raw-pass-but-dmarc-fail-unaligned/1646 "2021-10-11T17:46:40Z")\ **Posts on this page:** 10\ **Page:** 1
**Author:** ![csi-nyc-dmarc](https://avatars.discourse-cdn.com/v4/letter/c/439d5e/32.png) [@csi-nyc-dmarc](https://forum.dmarcian.com/u/csi-nyc-dmarc)\ **Post date:** [October 11, 2021, 5:46pm UTC](https://forum.dmarcian.com/t/aws-ses-spf-raw-pass-but-dmarc-fail-unaligned/1646/1 "2021-10-11T17:46:40Z")
Hello All- I’m a new user and I’m having a hard time understanding why email that has been sent from an authorized source (AWS SES) is showing SPF DMARC as “fail-unaligned”. This is happening despite the IP address shown in the “IP” column being directly included in my SPF record (It’s a dedicated IP from AWS). The funny thing is that the SPF “Raw” column shows as “pass”. So if that passes, why is the DMARC SPF listed as “fail-unaligned”? As a note, the DKIM DMARC does show as aligned so this is a pass, but it should be a pass on SPF as well. See image below for reference. Thank You! ![dmarc-spf-unaligned](https://canada1.discourse-cdn.com/flex036/uploads/dmarcian/original/1X/0c2f8eb1339cf69bc98ce90ffcdeabe8b25f83ca.png) ---
**Author:** ![LinkP](https://yyz2.discourse-cdn.com/flex036/user_avatar/forum.dmarcian.com/linkp/32/142_2.png) [@LinkP](https://forum.dmarcian.com/u/LinkP)\ **Post date:** [October 14, 2021, 8:35pm UTC](https://forum.dmarcian.com/t/aws-ses-spf-raw-pass-but-dmarc-fail-unaligned/1646/2 "2021-10-14T20:35:59Z")
Unaligned DMARC on SPF means that the RFC 5321 & RFC 5322 address domains don’t match. The RFC 5321 address is the email address used in the SMTP transaction. You will sometimes see it referred to as the return-path. In your example it is [amazones.com](http://amazones.com). The RFC 5322 address is the From address that is included in the email itself. In your sample image, this is the blurred domain in the first column. Since these domains do not match you cannot pass DMARC with your SPF, even though the raw SPF passes. I can’t really comment on your DKIM alignment in any detail since most of the relevant columns are truncated in your image. ---
**Author:** ![csi-nyc-dmarc](https://avatars.discourse-cdn.com/v4/letter/c/439d5e/32.png) [@csi-nyc-dmarc](https://forum.dmarcian.com/u/csi-nyc-dmarc)\ **Post date:** [October 15, 2021, 4:54pm UTC](https://forum.dmarcian.com/t/aws-ses-spf-raw-pass-but-dmarc-fail-unaligned/1646/3 "2021-10-15T16:54:26Z")
LinkP, Thanks very much for the clear explanation, appreciate it. Cheers! ---
**Author:** ![Gladis.Fox](https://avatars.discourse-cdn.com/v4/letter/g/b9bd4f/32.png) [@Gladis.Fox](https://forum.dmarcian.com/u/Gladis.Fox)\ **Post date:** [March 24, 2022, 11:39am UTC](https://forum.dmarcian.com/t/aws-ses-spf-raw-pass-but-dmarc-fail-unaligned/1646/4 "2022-03-24T11:39:01Z")
Hello, Are there recommendations how to fix it? How do I avoid this from happening again? Thanks! ---
**Author:** ![LinkP](https://yyz2.discourse-cdn.com/flex036/user_avatar/forum.dmarcian.com/linkp/32/142_2.png) [@LinkP](https://forum.dmarcian.com/u/LinkP)\ **Post date:** [March 29, 2022, 2:28pm UTC](https://forum.dmarcian.com/t/aws-ses-spf-raw-pass-but-dmarc-fail-unaligned/1646/5 "2022-03-29T14:28:07Z")
It’s unclear what you want to fix and prevent from happening. This thread is five months old and seemesto have run to completion. You might want to start a new thread explaining your issue. ---
**Author:** ![yisrael](https://avatars.discourse-cdn.com/v4/letter/y/a9a28c/32.png) [@yisrael](https://forum.dmarcian.com/u/yisrael)\ **Post date:** [July 13, 2023, 2:18pm UTC](https://forum.dmarcian.com/t/aws-ses-spf-raw-pass-but-dmarc-fail-unaligned/1646/6 "2023-07-13T14:18:12Z")
I too am faced with the issue that SPF is Raw Pass because the sending server’s IP is in my SPF record but the DMARC check on the SPF is “fail-unaligned” due to the fact that the FROM in the email is \.com whereas the PTR/Server is \.smtp-out.amazonses.com. The email does pass DMARC due to DKIM passing. The question is: is there any way to ensure that these emails will pass DMARC’s SPF check? After all, we do not want our emails to have a FROM that reads \.smtp-out.amazonses.com. We want the FROM to read \.com. Is there any way to avoid this misalignment while still having the FROM read \.com? Or do we just need to rely on our DKIM to pass DMARC? ---
**Author:** ![LinkP](https://yyz2.discourse-cdn.com/flex036/user_avatar/forum.dmarcian.com/linkp/32/142_2.png) [@LinkP](https://forum.dmarcian.com/u/LinkP)\ **Post date:** [July 13, 2023, 2:56pm UTC](https://forum.dmarcian.com/t/aws-ses-spf-raw-pass-but-dmarc-fail-unaligned/1646/7 "2023-07-13T14:56:09Z")
Your concerns are for naught. What you describe is s perfectly normal and extremely common DMARC scenario. If your DKIM verifies, then your DMARC will, too. I wouldn’t spend another moment worrying about something that is functioning as intended. ---
**Author:** ![yisrael](https://avatars.discourse-cdn.com/v4/letter/y/a9a28c/32.png) [@yisrael](https://forum.dmarcian.com/u/yisrael)\ **Post date:** [July 13, 2023, 5:06pm UTC](https://forum.dmarcian.com/t/aws-ses-spf-raw-pass-but-dmarc-fail-unaligned/1646/8 "2023-07-13T17:06:38Z")
Excellent, that is what I had hoped. Thanks! - Yisrael ---
**Author:** ![Asher](https://yyz2.discourse-cdn.com/flex036/user_avatar/forum.dmarcian.com/asher/32/104_2.png) [@Asher](https://forum.dmarcian.com/u/Asher)\ **Post date:** [July 13, 2023, 6:28pm UTC](https://forum.dmarcian.com/t/aws-ses-spf-raw-pass-but-dmarc-fail-unaligned/1646/9 "2023-07-13T18:28:20Z")
---
**Author:** ![Asher](https://yyz2.discourse-cdn.com/flex036/user_avatar/forum.dmarcian.com/asher/32/104_2.png) [@Asher](https://forum.dmarcian.com/u/Asher)\ **Post date:** [July 13, 2023, 6:29pm UTC](https://forum.dmarcian.com/t/aws-ses-spf-raw-pass-but-dmarc-fail-unaligned/1646/10 "2023-07-13T18:29:19Z")
In an effort to promote users to post their own topics without reviving old ones, this thread is now closed.