Skip to content
Webmaster Tools
EmailEmail DeliverabilityDMARC alignment

DMARC alignment

What DMARC alignment is, how the From domain must match the SPF and DKIM domains, the difference between relaxed and strict modes, and how to fix alignment failures.

What alignment means

Alignment is the rule that makes DMARC more than SPF plus DKIM. SPF and DKIM each authenticate some domain, but not necessarily the one the reader sees. DMARC (RFC 7489) requires that the domain which passed matches the domain in the visible From: header. A message passes DMARC when at least one of these is true:

  • SPF aligned: SPF passes, and the envelope sender domain (MAIL FROM, shown as Return-Path and smtp.mailfrom) matches the From domain.
  • DKIM aligned: a DKIM signature verifies, and its d= domain matches the From domain.

The three domains in a message

Return-Path: <bounce-123@mail.example.com>
DKIM-Signature: v=1; a=rsa-sha256; d=example.com; s=s1; ...
From: Example Shop <orders@example.com>
Domain Where Checked by
example.com From: header DMARC (the one that must be matched)
mail.example.com Return-Path / MAIL FROM SPF
example.com d= in DKIM-Signature DKIM

The receiver records them in Authentication-Results as header.from, smtp.mailfrom and header.d (or header.i). The Email Header Analyzer pulls them out for you.

Relaxed vs strict

The aspf and adkim tags in your DMARC record set the mode for SPF and DKIM. Both default to r.

Mode Tag Rule mail.example.com vs example.com
Relaxed aspf=r / adkim=r Same organizational domain Aligned
Strict aspf=s / adkim=s Exactly the same name Not aligned

The organizational domain is the registered domain, found with the Public Suffix List: for news.example.co.uk it is example.co.uk. Relaxed mode is right for almost everyone. Strict mode only makes sense if you need to keep subdomains from vouching for each other.

_dmarc.example.com.  TXT  "v=DMARC1; p=reject; adkim=r; aspf=r; rua=mailto:dmarc-reports@example.com"

Why alignment fails

  • A service signs with its own domain. The header shows dkim=pass header.d=esp.example.net next to header.from=example.com. DKIM passed, but it doesn't align.
  • A service uses its own bounce address. spf=pass smtp.mailfrom=bounces.esp.example.net. SPF passed, for someone else's domain.
  • Strict mode with subdomains. You send from example.com but bounce through mail.example.com with aspf=s.
  • A lookalike domain. example-mail.com is a different organizational domain and never aligns with example.com, in any mode.

How to fix it

For each sending service, set up both, if it allows it:

  1. Custom DKIM with d=example.com. Usually one or two CNAME records at selector._domainkey.example.com that the service gives you. This is the important one, because DKIM alignment survives forwarding.
  2. Custom return-path under your domain, such as bounce.example.com as a CNAME to the service. This gives aligned SPF under relaxed mode.

Some services only support one of the two. One aligned pass is enough for DMARC, so DKIM alone is fine.

Note that the include in your SPF record doesn't create alignment by itself. If the service uses its own return-path, the receiver checks its SPF record, and your include is never used for that message.

Check SPF, DKIM and DMARC for a domain with the Email Checker, adding your DKIM selector if you know it.