What is “alignment” in DMARC and how is it checked?

Still have a question, spotted an error, or have a better explanation or a source we should cite?

DMARC alignment is the comparison DMARC makes between the visible From domain and the domain that SPF or DKIM authenticated. When they match, alignment passes. When they don't, DMARC fails regardless of whether SPF or DKIM individually passed.

This is the check that actually enforces spoofing protection. Without alignment, authentication and the visible sender are completely independent.

How SPF alignment is checked

DMARC looks at the Return-Path domain (the behind-the-scenes bounce address your ESP sets) and compares it to the visible From domain. If they're the same domain (or a subdomain of it in relaxed mode), SPF alignment passes.

Common failure: your ESP sends with a Return-Path at their own subdomain, like bounce.youresp.com. SPF passes for their domain. But it doesn't align with your From domain. DMARC fails on SPF.

How DKIM alignment is checked

DMARC looks at the d= field in the DKIM-Signature header and compares it to the visible From domain. If your server is signing with d=yourdomain.com and From is support@yourdomain.com, DKIM alignment passes.

DMARC only needs one of the two (SPF or DKIM) to align. Both aligning is cleaner, but one is enough.

Strict vs relaxed mode

Your DMARC record includes alignment mode settings for both SPF (aspf=) and DKIM (adkim=):

Relaxed (default): subdomains align with the parent domain. mail.yourdomain.com aligns with yourdomain.com. This is what most senders should use.
Strict: only exact domain matches pass. mail.yourdomain.com does NOT align with yourdomain.com. Use only if you've fully mapped every sending subdomain.

Reading alignment results

Paste a received email header into our email header analyzer. The Authentication-Results line shows SPF, DKIM, and DMARC results including alignment status. dmarc=pass means at least one method aligned. dmarc=fail means neither did.

Our DMARC parser shows your current alignment mode settings. The SOS hotline is free if you're stuck on a specific alignment failure.

Contributors

Who worked on this answer

Every name links to their profile. Every company links to their site. Real people, real accountability.

Yanna-Torry (YT) Aspraki

Founder · Author

Review My Emails

Ask an AI · tailored to your setup

Diagnose My DMARC Alignment

I just read the Email Almanac entry on how DMARC alignment is checked. Help me diagnose whether my SPF and DKIM are actually aligning with my From domain. Walk me through: 1. Checking whether my Return-Path domain aligns with my From domain (SPF alignment) 2. Checking whether my DKIM d= domain aligns with my From domain (DKIM alignment) 3. Whether my alignment mode (strict vs relaxed) is configured correctly for my setup 4. Which change will fix my alignment if either is failing --- My details (fill in what applies): - Visible From domain: e.g. yourdomain.com - Return-Path or bounce domain: what your ESP uses, e.g. bounce.esp.com or your own domain - DKIM d= domain: domain in your DKIM signature - Current DMARC result: dmarc=pass / dmarc=fail / unsure - DMARC aspf= setting: strict / relaxed / unsure - DMARC adkim= setting: strict / relaxed / unsure - ESP: name

Edit the yellow boxes, then send to the AI of your choice.