Email authentication

What is DMARC alignment? Domain match in DMARC explained

Alignment means that the domain verified by SPF or DKIM matches the visible From domain. Without alignment a message fails DMARC even if SPF and DKIM pass.

How DMARC alignment works

For SPF, the domain of the Return-Path (envelope sender) is compared with the From domain; for DKIM, the signing domain from d=. DMARC needs just one of the two to pass and be aligned.

There are two modes: relaxed (the default) accepts subdomains of the same organisational domain, so news.example.com matches example.com. Strict requires exactly the same domain. You set this in the DMARC record with aspf= (SPF) and adkim= (DKIM), each r or s.

A typical problem: a newsletter service sends with its own Return-Path and signs with its own domain. SPF and DKIM pass – but not for your domain, so DMARC fails. The fix is a custom return path (custom bounce domain) and a DKIM signature with your domain at the provider.

Example

_dmarc.example.com.  TXT  "v=DMARC1; p=reject; adkim=s; aspf=s"

Strict alignment: only exactly example.com in the Return-Path or in d= counts.

Common mistakes

Strict alignment set although mail runs through subdomains such as bounce.example.com.
Providers sign only with their own domain (d=provider.com).
SPF passes only for the provider's Return-Path – without DKIM for your own domain, alignment is missing.

How the Domain Trust Check rates DMARC alignment

Criterion “DMARC” (weight 5 of 5): DMARC record at _dmarc, policy p=none/quarantine/reject, percentage (pct), aggregate reports (rua) incl. authorisation of external receivers, subdomain policy (sp) and alignment (adkim/aspf).

Standard: RFC 7489, section 3.1