When SPF or DKIM alignment fails
In short: SPF alignment fails for Zoho Campaigns emails by default because the bounce (Return-Path) domain is zcsend.net, not your business domain. Your emails still pass DMARC as long as DKIM is authenticated and aligned with your "From" domain, and you can align SPF as well by setting up a Custom Return Path.
A DMARC check includes SPF and DKIM alignment. If your DMARC report says that SPF or DKIM alignment has failed for your emails even though you've properly authenticated your domain with Zoho Campaigns, read the information below to learn why this may have happened and how to resolve it.
DMARC check
When an email is received, the recipient system first checks the SPF and DKIM results for that email and then checks whether the domain behind each passing result is aligned with the "From" domain that the recipient sees. Complying with DMARC policy tells the recipient systems that the email sender has done something that only an authentic sender can do: align the DKIM and/or SPF domain with the "From" domain that the recipient sees. Only one aligned pass is needed.
SPF alignment
If you're sending emails through your business domain as "From", DMARC will compare it with the "Envelope From" (also known as "Return-Path") domain. If both the domains or their subdomains match, SPF is aligned. By default, DMARC uses relaxed alignment, in which the two domains only need to share the same organizational domain (for example, bounce.example.com aligns with example.com). If your DMARC record sets aspf=s (strict alignment), the two domains must be identical.
Why SPF alignment fails
If you're using an email marketing service to send emails, the "Envelope From" domain is the domain of the marketing service. It is the domain used to receive bounce error messages from recipient systems. In your case, Zoho Campaigns uses "zcsend.net" as the "Envelope From" domain to collect the bounce error messages so we can display the bounce rate and reasons in your campaign report. During the DMARC check, this "Envelope From" domain will not match with the actual sender's business domain, so SPF alignment will fail. This happens not only with Zoho Campaigns but with any email marketing service. You can change this in Zoho Campaigns by setting up a Custom Return Path, as described below.
Why DKIM alignment fails
DKIM alignment compares the domain in the email's DKIM signature (the d= value) with the "From" domain. If the email is signed with a domain other than yours, DKIM can pass but still not align. This is why your sender domain needs a published and verified DKIM record: without it, your emails are not signed with your domain, and DKIM alignment fails.
How to resolve
DMARC requires either SPF or DKIM alignment. So, if you have DKIM authentication, you will pass the DMARC check even without SPF alignment, as long as your DKIM signature stays valid. SPF alignment failing on its own won't affect your email deliverability. This is also what Gmail, Yahoo, and Outlook.com expect from senders of 5,000 or more emails a day: SPF and DKIM set up, and DMARC passing through either one, with Microsoft recommending alignment with both.
If you'd like SPF to align as well, set up a Custom Return Path. It replaces the default zcsend.net return path with a subdomain of your own domain (for example, bounce.yourdomain.com), so the "Envelope From" domain matches your "From" domain and SPF aligns. You can set up a Custom Return Path only after you've configured SPF and DKIM. To learn how, see Senders & Authentication in Zoho Campaigns.
Having both SPF and DKIM aligned is the strongest setup. SPF often breaks when an email is forwarded, while DKIM signatures generally remain valid, so an aligned DKIM signature is your safety net.
What you should do
If you don't have DKIM authentication, both SPF and DKIM alignment will fail, and your email won't pass the DMARC check. What happens next depends on your DMARC policy: with p=none, failing emails are only reported, but with p=quarantine or p=reject, they can be sent to the spam folder or rejected. So, we recommend that you authenticate your domain with both SPF and DKIM to pass DMARC and improve your email deliverability, and then set up a Custom Return Path so that SPF aligns too.