What does DMARC alignment mean?
DMARC evaluates whether an email claiming to be from your domain is actually authorized by your domain. It relies on two underlying mechanisms: SPF and DKIM. But in DMARC, it’s not enough that “SPF passed” or “DKIM passed.” The key requirement is alignment.
Alignment is DMARC’s way of tying the authentication results back to what the recipient sees in the From address. In other words, DMARC asks: “Does the domain the user sees in the From header match the domain that passed SPF or DKIM?” This closes a common gap attackers exploit when they spoof the From address while using their own infrastructure for delivery.
Why DMARC focuses on the From domain
Most recipients decide whether a message is trustworthy by looking at the From name and address. Attackers know this and often forge the From domain to impersonate a company. SPF typically validates the hidden envelope identity (often the Return-Path / MAIL FROM domain), while DKIM validates a cryptographic signature associated with a signing domain (the d= value). DMARC connects these checks to the From domain so that the brand shown to users is backed by authentication.
How SPF alignment works
SPF checks whether the sending server’s IP address is permitted to send mail for a given domain. For DMARC, the important question is which domain SPF is evaluating, and whether that domain aligns with the From domain.
Which domain is compared?
DMARC SPF alignment usually compares the domain found in the envelope-from identity (the Return-Path / MAIL FROM domain) to the domain in the visible From header. While HELO/EHLO can be involved in SPF evaluation, alignment discussions in real-world administration are primarily about the Return-Path domain.
Example
If the From address is user@example.com, but the Return-Path is bounce.mail.example.com and SPF passes for that subdomain, DMARC may consider it aligned in relaxed mode. In strict mode, it would not be aligned unless the SPF-authenticated domain is exactly example.com.
How DKIM alignment works
DKIM adds a digital signature to the message so recipients can validate that parts of the email haven’t been altered and that a domain took responsibility for signing it. DMARC then checks whether the DKIM signing domain (d=) aligns with the From domain.
Example
If the From address uses example.com but the DKIM signature uses d=mailer.example.com, relaxed alignment can treat this as aligned. Strict alignment requires an exact match, meaning d=example.com.
Relaxed vs strict alignment: what’s the difference?
DMARC offers two alignment modes: relaxed and strict. They can be set independently for SPF and DKIM using the aspf and adkim tags in your DMARC record.
- Relaxed alignment: The domains are considered aligned if they share the same organizational domain. In practice, this often means the root domain matches even if subdomains differ.
- Strict alignment: The domains must match exactly. A subdomain and its parent domain are not considered aligned.
Relaxed is more tolerant of real-world setups; strict enforces tighter consistency, but can cause legitimate mail to fail DMARC if your sending architecture isn’t standardized.
Why “organizational domain” matters
Relaxed alignment is based on the concept of the organizational domain (the registrable domain). It’s what allows example.com and mail.example.com to be treated as belonging to the same organization for alignment purposes. This flexibility helps companies operate multiple mail streams (transactional, notifications, support tools) without having to force every system into a single exact domain identity.
However, that flexibility doesn’t replace good architecture. If you have many senders and inconsistent From/Return-Path/DKIM domains, relaxed alignment can make it harder to notice misconfigurations unless you regularly review your DMARC reporting and sending inventory.
When relaxed alignment is the right choice
Relaxed alignment is a practical default for many organizations, especially during rollout. It tends to reduce accidental DMARC failures caused by subdomain usage and third-party tooling.
- You send from subdomains: For example, transactional.example.com or mail.example.com is part of normal operations.
- Multiple systems send mail for the same brand: Ticketing systems, CRM, web apps, printers/scanners, monitoring tools, and other services may have different envelope identities.
- You’re stabilizing your environment: Early DMARC deployments (especially while still validating all senders) often go more smoothly with relaxed alignment to avoid disrupting legitimate flows.
Relaxed alignment is not “insecure by default.” With well-managed SPF/DKIM and a clear sending strategy, it can provide strong protection while remaining operationally feasible.
When strict alignment makes sense
Strict alignment is best when you can confidently enforce consistent domain usage across all sending sources. It can reduce ambiguity and prevent edge cases where a subdomain behaves differently than intended.
- Standardized sending identity: You can ensure both the visible From domain and the SPF/DKIM domains are exactly the same everywhere.
- High impersonation risk workflows: Finance, executive, payroll, and procurement communications benefit from maximum domain consistency.
- Clear separation of mail streams: You’ve intentionally split mail types across domains/subdomains and want tight rules per domain.
The tradeoff is that strict alignment is less forgiving: a small configuration drift, a vendor change, or a new tool can cause DMARC failures until corrected.
Common symptoms of alignment problems
Alignment issues often confuse teams because SPF and DKIM can show “pass” individually while DMARC still fails. That’s because DMARC requires a pass plus alignment for at least one of the two methods.
Typical signs include:
- Some recipients consistently route your emails to spam
- Messages from specific systems are rejected while others deliver
- DMARC reports show unexpected domains in Return-Path or DKIM d= values
- Support tickets indicating “authentication failed” despite SPF being present
How to plan an alignment strategy without breaking mail
1) Inventory every sender
List every source that sends mail using your domain: user mailboxes, applications, marketing broadcasts, helpdesk tools, invoicing systems, monitoring alerts, and any third-party integrations. Alignment failures usually come from “forgotten” senders.
2) Define your From domain policy
Decide which domains or subdomains are allowed in the visible From address for each type of mail. Many organizations separate operational mail and bulk/marketing mail into different subdomains to protect brand reputation and simplify troubleshooting.
3) Align SPF and DKIM to the chosen From domains
For each sender, ensure that at least one of SPF or DKIM will both pass and align with the From domain. DKIM alignment is often more controllable for third-party senders because it can sign with a domain that matches the From identity when configured properly.
4) Choose aspf/adkim intentionally
If your environment uses subdomains heavily, relaxed alignment is often the realistic baseline. If you can enforce exact matching everywhere, strict can be a strong final state. You can also tighten one side first (for example, strict DKIM alignment) while keeping the other relaxed during transition.
5) Roll out changes in controlled steps
Make changes gradually, starting with the highest-volume and most business-critical mail streams. This makes it easier to isolate problems and avoid widespread delivery disruptions.
Practical scenarios and recommended thinking
Third-party sending on behalf of your domain
If a vendor sends email that displays your domain in the From address, alignment is where many deployments succeed or fail. In many cases, the cleanest approach is to configure DKIM so the vendor signs with a d= domain that aligns with your From domain. If the vendor’s Return-Path remains on their infrastructure, strict SPF alignment can create unnecessary failures.
Do you need both SPF and DKIM aligned?
DMARC technically requires only one: either SPF passes and aligns, or DKIM passes and aligns. But for resilience, many organizations aim for both. If one breaks due to routing changes or a vendor update, the other still supports DMARC compliance.
Quick alignment checklist
- From domain: Is it consistent with your policy for that mail stream?
- Return-Path domain: Do you know what it is for each sender, and can you control it?
- DKIM d= domain: Is it expected and aligned with the From domain?
- aspf/adkim settings: Are they chosen based on your actual architecture (not guesswork)?
- Change management: When a new tool starts sending mail, is alignment reviewed before go-live?
Conclusion: DMARC works when alignment is designed, not assumed
DMARC’s real strength comes from alignment: linking authentication to the domain your recipients see. Relaxed alignment offers operational flexibility for subdomains and mixed sender environments, while strict alignment provides tighter consistency when your sending identity is standardized. The right choice depends on how your organization sends email today and how much control you have over each source.
If you manage your domain’s mail flow with MX1Mail or plan a migration, building your SPF/DKIM/DMARC setup with alignment in mind from the start helps avoid delivery surprises and makes long-term administration significantly easier.