What is DMARC strict vs. relaxed alignment?
Still have a question, spotted an error, or have a better explanation or a source we should cite?
DMARC alignment determines whether a message passes DMARC by checking how closely the authenticated domain needs to match your "From" domain. There are two modes: relaxed and strict. You set them with the aspf= tag (for SPF alignment) and adkim= tag (for DKIM alignment). Both default to relaxed if you don't specify.
Relaxed alignment (the default) means the authenticated domain just needs to share the same organizational domain as the "From" domain. So if your From is captain@deepcurrent.io and your DKIM signature shows d=mail.deepcurrent.io, that passes relaxed DKIM alignment because both share deepcurrent.io as the organizational domain. This is permissive, and it's the right setting for most senders because ESPs often sign with subdomains.
Strict alignment means the authenticated domain must match the "From" domain exactly, including the subdomain. d=mail.deepcurrent.io signing a message From deepcurrent.io would fail strict DKIM alignment, even though they share the same root domain.
In practice, strict alignment causes more legitimate mail to fail DMARC. Most organizations use relaxed for DKIM (adkim=r) and relaxed for SPF (aspf=r). The default is relaxed, and that's usually what you want.
When strict makes sense: if you need to ensure that only exact subdomain matches count for authentication, typically in high-security environments where impersonation of specific subdomains is a concern.
If you're troubleshooting DMARC failures and your authentication checks are passing but DMARC is still failing, alignment is worth checking. It's one of the more common causes. Our free DMARC parser shows alignment results in the reports it parses.
For more on DMARC alignment generally and how it works in the context of SPF and DKIM, see the alignment problem DMARC was built to solve.
Contributors
Who worked on this answer
Every name links to their profile. Every company links to their site. Real people, real accountability.
