Alignment is the heart of DMARC, defined in RFC 7489. SPF and DKIM each authenticate a domain, but not necessarily the one your recipients see. DMARC adds the rule that the authenticated domain must match the domain in the visible From header (the RFC5322.From). Without this link, a sender could pass SPF using their own domain while spoofing yours in the From line.
A message passes DMARC when it is aligned through either SPF or DKIM, not necessarily both. SPF alignment compares the Return-Path (MAIL FROM) domain with the From domain. DKIM alignment compares the d= domain in the DKIM signature with the From domain.
Alignment can be relaxed (the default), where the organisational domain must match, so mail.example.com aligns with example.com; or strict, set with aspf=s or adkim=s, where the domains must be identical.
Most DMARC failures during a rollout are simply alignment gaps from third-party senders, not outright forgery. Use our reporting tools to see which sources are unaligned, then fix SPF and DKIM so they line up with your From domain.
Check it on your domain
- DMARC Checker: look up and validate a domain's DMARC record and policy.
- DMARC Report Analyser: read a DMARC aggregate (RUA) report in plain English.
- DMARC Analyser: full DMARC, SPF and DKIM analysis with a readiness score.