A new brand name in a display label is not the same change as a new domain in the From address. The latter changes the identity against which DMARC alignment is assessed. A perfectly valid old-domain signature can therefore stop helping the newly branded message. Plan the identity transition before the launch announcement, including transactional applications that the communications team does not own.
Separate the identity fields
For each route, capture the visible From address, envelope sender, DKIM d= domain and selector, and Reply-To address. The display name is presentation. Reply-To directs replies. Neither substitutes for the authenticated identifier used by DMARC. RFC 9989 defines alignment; RFC 6376 defines the signing identity and selector lookup.
Do not assume old and new brand domains align because one company owns both. Under strict alignment the domain names must match. Relaxed alignment uses the protocol's organizational-domain relationship, not a list of company acquisitions. The following example assumes strict DKIM alignment and isolates one signature; it does not implement DMARC discovery or determine the whole message result.
Establish the new domain before the cutover
Inventory marketing, employee mail, invoices, password resets, support tickets and low-frequency alerts. For each, configure the provider-supported new sending identity and required DNS, using values generated for the actual account. Obtain trusted receiver results from controlled test messages. Check both authentication and the business workflow: a reset message that passes DMARC but contains a broken link is not ready.
Keep a documented path for replies and old addresses. Continuing to receive mail at the old domain is separate from continuing to authorize outbound senders. Agree how long old identities remain needed and how delayed messages signed with old selectors will be handled. Avoid removing a public key merely because the last newly generated message has switched.
Compare four hypothetical signing outcomes
Assume From is oldbrand.test and a valid signature has d=oldbrand.test: that signature aligns strictly. Change only From to newbrand.test, retaining the valid old-domain signature: it no longer aligns strictly. A valid signature with d=newbrand.test restores this aligned DKIM path. If that new-domain signature fails verification, matching domain text alone cannot supply a passing path. These are assumed inputs and hand-worked comparisons, not executed code or cryptographic verification.
Another valid aligned signature or aligned SPF pass could still satisfy the message-level DMARC rule. Inspect all relevant paths before declaring failure, and do not infer receiver disposition or inbox placement. Separately, RFC 9989 sections 7.4 and 8 require p=reject domains to use valid DKIM signatures and not rely solely on SPF. Before launch, verify the reset transaction as well as authentication: a broken reset link remains a business failure even with an aligned pass.
Stage the launch and define recovery
Move one approved stream first and watch its application outcomes, receiver results and reports. Aggregate reports are delayed observations from participating receivers, not a complete launch monitor. Add direct checks for the flows that matter to the business. A healthy marketing volume must not hide an invoice or reset failure.
Define rollback before launch: who can restore the prior From identity, whether the old authentication remains valid, and what happens to already queued mail. Reverting only the display name cannot repair an alignment failure. Retire old sending permissions when the final authorized stream has moved and the delayed-mail plan has completed. Preserve the old-domain ownership and inbound-routing decisions separately from the outbound retirement record.