What are organizational domains in DMARC?

When DMARC checks alignment in relaxed mode, it doesn't require an exact domain match. It checks whether the authenticated domain shares the same organizational domain as the "From" header. Understanding what counts as an organizational domain is what makes relaxed alignment make sense.

An organizational domain is the registrable domain: the part of a domain name that was actually registered, not a subdomain added on top of it. For most domains, that's straightforward: deepcurrent.io is the organizational domain for mail.deepcurrent.io, marketing.deepcurrent.io, and deepcurrent.io itself.

The less obvious part: how does DMARC determine where the organizational domain ends? It uses the Public Suffix List, a maintained list of domain suffixes under which domains can be registered (like .com, .co.uk, .com.au). Anything one level above the public suffix is the organizational domain. So deepcurrent.co.uk is the organizational domain for mail.deepcurrent.co.uk, not deepcurrent.co or just .co.uk.

Why this matters for you: in relaxed DKIM alignment, if your "From" domain is deepcurrent.io and your ESP signs with d=mail.deepcurrent.io, DMARC passes because both share the same organizational domain. That's the whole point of relaxed mode: it accommodates the common pattern of ESPs signing with a sending subdomain rather than the exact From domain.

In strict mode, organizational domain matching is ignored. The signed domain must exactly equal the From domain. That's why strict mode causes more failures: subdomains can't ride on the parent domain's organizational match.

You rarely need to think about organizational domains explicitly unless you're debugging alignment failures or evaluating edge cases with multi-level domain structures. For most senders using standard domain configurations, the defaults handle it correctly. See DMARC alignment modes for how this applies to your specific authentication setup, and DMARC for the full context.