How to Fix Cloudflare Redirect Loops in WordPress

SPF and DKIM can both pass while DMARC fails. That happens when they authenticate a mail provider’s domain instead of the domain people see in your From address. Adding another SPF include will not necessarily change that.

This guide shows how to identify the mismatch and fix the sending service. You need access to your domain’s DNS, the service sending the messages, and a receiving mailbox that can show the original message headers. No server configuration file is needed.

Identify the three domains

DMARC checks the domain in the visible From: header. It passes when at least one of these paths succeeds:

• SPF passes, and its authenticated domain aligns with the From domain.
• A DKIM signature passes, and its d= domain aligns with the From domain.

A passing result for an unrelated domain is not enough. Neither the display name nor Reply-To determines alignment.

Identity	Where to find it	Example
Visible From	From: header; receiver’s header.from result	[email protected]
SPF identity	Receiver’s smtp.mailfrom result; usually reflected in Return-Path	[email protected]
DKIM signing domain	d= in DKIM-Signature	vendor.example.net

SPF normally authenticates the SMTP envelope sender, not the visible From address. The examples below use ordinary messages with a nonempty envelope sender.

Read the receiver’s authentication results

Send a new message through the affected application to a mailbox you control. In Gmail, open the message’s menu and choose Show original. Other mail clients offer a message-source or headers view.

Find Authentication-Results added by the receiving service. Messages can contain several such headers, including ones inserted before delivery. Use the results belonging to your trusted receiver, not an arbitrary header claiming dmarc=pass.

These selected header lines are from our controlled lab message. Other headers and DKIM continuation lines are omitted. The domains are documentation examples, not a live customer’s mail:

From: Billing <[email protected]>
Return-Path: <[email protected]>
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=vendor.example.net;
Authentication-Results: receiver.example.org;
 dkim=pass [email protected] header.s=kb2026 header.a=rsa-sha256 header.b=LVY8ykqG;
 spf=pass (receiver.example.org: domain of [email protected] designates 192.0.2.10 as permitted sender)
 [email protected] smtp.helo=outbound.vendor.example.net;
 dmarc=fail (p=REJECT) header.from=example.org header.d=example.org

Use the signature’s d= value for DKIM alignment; header.i is a different identity and may not be shown by every receiver. Both authentication checks passed here, but neither authenticated example.org or an aligned domain. This is an alignment problem, not evidence that SPF or DKIM is broken.

If SPF or DKIM does not pass, inspect the receiver’s reason as well as the domain. For example, our verifier reported a damaged message body as dkim=neutral (body hash did not verify). An aligned signing domain still cannot supply a DMARC pass unless its signature passes. When no message arrives, check the sender’s bounce and delivery log first; an SMTP error alone does not establish the cause.

Check relaxed versus strict alignment

The DMARC tags aspf and adkim control SPF and DKIM alignment independently. Both default to relaxed (r) when omitted.

Mode	What must match	Example with From domain example.org
Relaxed (r)	The organizational domain	mail.example.org can align
Strict (s)	The complete domain	Only example.org aligns

An organizational domain is not simply the last two labels of a hostname. The current DMARC specification, RFC 9989, uses DNS-based domain-boundary discovery; older receivers may still use public-suffix-based discovery. The examples here use ordinary domains without special boundary policies. An exact-domain match avoids that difference.

Check the policy before choosing a provider’s custom bounce subdomain. bounce.example.org can work with relaxed SPF alignment, but it will not satisfy aspf=s when From is example.org. Do not weaken an intentional strict policy just to fit a provider’s default settings. An exactly aligned DKIM signature may be the better solution.

Query the DNS names that matter

Each $ below marks a terminal command; do not copy the prompt. Replace the documentation domains and selector with the values from your own message. These commands read DNS; they do not change it.

On Ubuntu, install dig if needed:

$ sudo apt-get update
$ sudo apt-get install -y dnsutils

For the failing example above, query:

$ dig +short TXT _dmarc.example.org.
$ dig +short TXT bounce.vendor.example.net.
$ dig +short TXT kb2026._domainkey.vendor.example.net.

The first query checks the From domain’s DMARC policy. The second checks the domain SPF actually authenticated. The third combines the DKIM selector (s=) and signing domain (d=). Querying only example.org for SPF would miss the identity used in this message.

An illustrative DMARC response is:

"v=DMARC1; p=reject; adkim=r; aspf=r"

This is an example to read, not a replacement record to publish. If no record exists at a From subdomain, a receiver can discover policy higher in the domain hierarchy; a blank result at one name is not proof that DMARC is absent everywhere.

DKIM services may use a CNAME pointing to a provider-managed key. Inspect it when troubleshooting:

$ dig +short CNAME kb2026._domainkey.vendor.example.net.

Several quoted strings on one TXT response line can be fragments of one record, particularly for long DKIM keys. That is different from publishing multiple separate DMARC records at the same name. DNS output alone does not prove that a live message was signed or authenticated successfully.

Fix DKIM alignment at the sending service

For many hosted mail services, custom DKIM is the simplest fix. In the service that actually sends the message, look for domain authentication, custom DKIM, or verified sending domain.

1. Add the domain used in your From address, such as example.org.
2. Copy the service’s exact DNS record names, record types, and values into the DNS zone hosting that domain. Publish its supplied TXT key or CNAME target; do not invent a selector or key.
3. Wait for the service to verify those records, then enable signing for the domain. A domain-verification success message alone does not prove DKIM is enabled.
4. Send a fresh message through the same application and inspect the receiver’s results.

The intended result is a passing DKIM signature with d=example.org. A provider’s additional signature is fine: one passing, aligned signature is sufficient for the DKIM path.

If you use cPanel, Email Deliverability can help inspect the domain’s local mail setup. But changing local DKIM records does not make an external newsletter or transactional provider sign with your domain. Configure the service responsible for that particular stream of mail.

Some DNS editors append your zone name automatically. Check that a selector record did not become kb2026._domainkey.example.org.example.org. Preserve existing policy settings. Where an SPF or DMARC record already exists, update that record instead of adding a second one at the same name.

Fix SPF alignment with a custom envelope sender

If the provider supports custom MAIL FROM, custom Return-Path, or custom bounce domain, configure a domain you control. With relaxed alignment, that might be bounce.example.org while visible From remains [email protected].

Follow the provider’s instructions for that bounce domain, including any required SPF, MX, or CNAME records. These requirements differ between providers, so there is no universal record value to paste. Check strict alignment first, as described above.

Then send another message and confirm the receiver reports SPF passing for the new envelope domain. Editing a Return-Path header in your application is not a substitute for changing the SMTP envelope sender used by the service.

Adding an SPF include to example.org does not align a message whose envelope sender is still under vendor.example.net. It may authorize a server for a different identity, but it does not change the identity DMARC compares.

For WordPress contact forms, use your own authenticated address in From and put the visitor’s address in Reply-To. Sending as the visitor’s Gmail or company domain asks your server to authenticate a domain you do not control.

Retest every sending application

Test website notifications, regular mailbox mail, newsletters, and transactional mail separately. They may use different providers even though their From addresses share a domain.

After the provider activates the change and relevant DNS caches expire, inspect a new received message. Look for:

• The intended visible From domain.
• dmarc=pass from the trusted receiver.
• At least one passing SPF or DKIM identity that actually aligns, using the policy’s alignment mode.

Changing p=reject to p=none does not turn a DMARC failure into a pass. It changes the domain owner’s requested handling of failures. Likewise, a dmarc=pass result does not guarantee inbox placement: reputation, spam filtering, and recipient policy still matter. Gmail’s bulk-sender requirements, for example, require both SPF and DKIM even though DMARC itself needs only one aligned passing path.

Forwarding can break SPF because the connecting server changes. An aligned DKIM signature may survive forwarding, but modifications to signed content can break it. Inspect the received message instead of assuming the direct-delivery result still applies.