DMARC alignment means the domain that passed SPF or DKIM must match the domain in the visible From address. Relaxed alignment, the default for adkim and aspf, accepts a match on the organisational domain. Strict alignment needs an exact match. A message passes DMARC when SPF or DKIM passes and is aligned.
Why it matters
SPF and DKIM can pass for a domain that has nothing to do with the From address. A bulk mail service may sign a message with its own domain, and SPF may pass for its own bounce address. Without alignment, a forger could send mail that passes those checks yet shows your domain to the reader. Alignment is the rule that closes that gap, and it is the most common reason a message passes SPF and DKIM yet still fails DMARC.
How to check
Two domains are compared with the From domain:
- SPF alignment uses the domain in the Return-Path (the envelope sender, or MAIL FROM address), controlled by
aspf. - DKIM alignment uses the
d=domain in the DKIM signature, controlled byadkim.
Each tag takes r for relaxed or s for strict. Both default to relaxed.
| From domain | Authenticated domain | Relaxed | Strict |
|---|---|---|---|
| example.com | example.com | aligned | aligned |
| example.com | mail.example.com | aligned | not aligned |
| mail.example.com | example.com | aligned | not aligned |
| example.com | mailservice.example.net | not aligned | not aligned |
To test your own mail:
- Send a message from each system that uses your domain to a mailbox you control.
- Open the original message source and find the
Authentication-Resultsheader. - Note the domain shown for
smtp.mailfrom(SPF) andheader.d(DKIM), and compare them with theheader.fromdomain. - If neither lines up, ask your provider to sign with your domain, which means adding the DKIM records they give you, or to use a custom return-path domain.
To set the tags, add them to your record:
v=DMARC1; p=quarantine; adkim=r; aspf=r; rua=mailto:dmarc-reports@example.com
RFC 7489 determines the organisational domain with the Public Suffix List, a published list of registry-controlled endings such as .com and .co.uk.
Common mistakes
- Seeing
spf=passanddkim=passand assuming DMARC passes. Check that the passing domains line up. - Choosing strict alignment before every sender signs with your exact domain.
- Using a third-party service without adding the DKIM records it provides for your domain.
- Forgetting that SPF alignment depends on the Return-Path, not the From address.
- Changing alignment and policy at the same time, which hides the cause of any new failures.
Frequently asked questions
Do SPF and DKIM both have to align?
No. DMARC passes if either one passes and is aligned. Having both gives you a fallback.
Should I use strict alignment?
Relaxed is a sensible default and easier to maintain. Strict suits cases where every sender uses the exact From domain and you want extra control.
Where do the tags go?
In the DMARC TXT record at _dmarc.yourdomain. See What does a correct DMARC record look like?.
Related guides
Want to check a live domain? Try the free website sample.