22 June 2026 · 5 min read
DMARC alignment means the domain that SPF or DKIM authenticated matches the domain in the visible From address. SPF aligns when the envelope sender (Return-Path) domain matches the From domain. DKIM aligns when the d= domain in the signature matches it. A message passes DMARC when at least one of them both passes and aligns. In the default relaxed mode, "matches" means the two share an organisational domain; in strict mode they must be identical.
The three domains in every message
| Identifier | Where it lives | Checked by |
|---|---|---|
| From domain | The From: header the recipient sees, for example news@example.com | DMARC, which anchors to it |
| Envelope sender domain | The SMTP MAIL FROM, recorded as Return-Path: | SPF |
| DKIM signing domain | The d= tag in the DKIM-Signature header | DKIM |
SPF and DKIM never look at the From header. DMARC's job, defined in RFC 9989, is to compare the domains they authenticated with it.
SPF alignment
SPF aligns when both are true:
- SPF passes for the envelope sender domain.
- That domain matches the From domain under the alignment mode in force.
Many email platforms set the envelope sender to their own bounce domain so bounces return to them:
From: news@example.com
Return-Path: bounces@platform-mail.exampleSPF passes for platform-mail.example, which does not match example.com, so SPF is authenticated but not aligned. The fix is a custom Return-Path (also called a custom bounce or MAIL FROM domain) on a subdomain such as bounce.example.com, where the platform supports one. SPF also stops aligning when mail is forwarded, because the forwarding server's IP is not in your record.
DKIM alignment
DKIM aligns when both are true:
- A DKIM signature verifies for some
d=domain. - That domain matches the From domain under the alignment mode in force.
Platforms often sign with their own domain until you complete their domain authentication:
From: news@example.com
DKIM-Signature: ... d=platform-mail.example; s=s1; ...The signature verifies, but for platform-mail.example, so DKIM is authenticated but not aligned. Once you publish the records the platform gives you, usually CNAMEs at <selector>._domainkey.example.com, it signs with d=example.com and DKIM aligns.
DKIM alignment is the more dependable of the two, because the signature travels with the message and usually survives forwarding as long as nobody edits the signed content.
Relaxed and strict alignment
Two tags in your DMARC record set the mode. Both default to relaxed.
aspf=roraspf=sfor SPF.adkim=roradkim=sfor DKIM.
Relaxed alignment requires the same organisational domain. With a From address on example.com, all of these align:
example.commail.example.combounce.eu.example.com
example.co.uk and example-mail.com do not, because they are different organisational domains.
Strict alignment requires identical domains. Under adkim=s, a signature with d=mail.example.com does not align with a From address on example.com, even though both are yours.
Under RFC 9989, receivers find the organisational domain with a DNS tree walk over DMARC records, rather than the Public Suffix List the older RFC 7489 relied on. For ordinary domains the result is the same: news.example.co.uk and example.co.uk share the organisational domain example.co.uk.
Relaxed is the right choice unless you have a specific reason for strict. Strict mode breaks any sender that signs or bounces on a subdomain of yours.
Worked examples
DMARC record v=DMARC1; p=reject (relaxed by default) unless stated, with a From address on example.com:
| Envelope sender | DKIM d= | SPF aligned? | DKIM aligned? | DMARC |
|---|---|---|---|---|
platform-mail.example | example.com | No | Yes | Pass on DKIM |
example.com, no DKIM signature | none | Yes | No | Pass on SPF, but fails if forwarded |
platform-mail.example | platform-mail.example | No | No | Fail, although SPF and DKIM both passed |
platform-mail.example | mail.example.com, with adkim=s | No | No (strict) | Fail; relaxed would pass |
bounce.example.com | mail.example.com | Yes | Yes | Pass on both |
The third row is the classic surprise. Why DMARC fails when SPF and DKIM pass shows how to find which sender is causing it.
Subdomain From addresses
Alignment is always judged against the exact From domain. If mail comes from alerts@notify.example.com and there is no DMARC record at notify.example.com, receivers use the record at example.com and apply its subdomain policy (sp=, or p= if sp= is absent). An envelope sender of notify.example.com aligns exactly, and under relaxed mode example.com or bounce.example.com would align too.
Reading alignment in your reports
Aggregate reports show, for each sending source, the raw SPF and DKIM results with the domains they were checked against, plus the aligned results in the policy_evaluated section. A raw pass next to an aligned fail is an alignment problem. For each failing legitimate source, ask:
- Did SPF pass, and does the envelope domain match the From domain? If not, set a custom Return-Path or rely on DKIM.
- Did DKIM pass, and does
d=match the From domain? If not, complete the platform's DKIM setup.
The DMARC report analyser turns the XML into a per-source view, and the DMARC checker shows which alignment mode your record sets. Fix alignment for every legitimate source before you move past p=none; p=none vs quarantine vs reject explains the stages.
Common alignment mistakes
- Relying on SPF alignment alone. It fails on forwarding and on any platform that uses its own bounce domain.
- Leaving a platform on its default DKIM. The signature verifies but never aligns.
- Copying
adkim=soraspf=sfrom an example. It fails your own subdomain senders. - Treating a valid SPF or DKIM result as a DMARC pass. Valid authentication for the wrong domain still fails DMARC.
If you would rather have every sender's alignment tracked for you, DMARC analytics breaks your aggregate reports down by source and shows which mechanism aligns for each.