What DMARC alignment means
SPF authenticates the envelope sender, the address given in MAIL FROM. DKIM authenticates the signing domain in the d= tag. Neither has anything to do with the From header a reader is shown, and a message can pass both while displaying somebody else's name. DMARC alignment is the requirement that closes that gap: the identifier that authenticated must match the header From domain.
There are two modes. Relaxed alignment — the default, adkim=r and aspf=r — accepts any subdomain of the same organisational domain, so mail signed by mail.example.com aligns with a From address at example.com. Strict alignment, adkim=s or aspf=s, demands an exact match. Relaxed is right for almost every domain; strict is for the ones that have established they need it.
Alignment is where deployments fail, and the failure looks like a success. A bulk platform that puts its own domain in the envelope sender passes SPF and fails SPF alignment; one that signs with its own d= passes DKIM and fails DKIM alignment. Aggregate reports separate the two, recording the raw authentication results alongside the aligned ones, which is why reading them is the only dependable way to find out which of your senders is which.
See it on your own domain. Every term in this glossary is something one of the eleven checks reads and reports.
Browse the lookupsKeep reading
Related checks, definitions and guides.
- DMARC The policy alignment is evaluated against.
- Envelope sender The identifier SPF alignment compares.
- Header From The domain both checks have to agree with.
- Making sense of DMARC aggregate reports Where alignment failures become visible per source.
- How email authentication fits together SPF, DKIM and the alignment that binds them to one identity.