What happens with alias addresses under DMARC?
Still have a question, spotted an error, or have a better explanation or a source we should cite?
It depends on what the mail server actually does when the alias receives a message. "Alias" can mean a few different things, and each behaves differently under DMARC.
Simple forwarding (sales@ passes the message along unchanged to bob@): SPF breaks because the forwarding server's IP replaces the original server's IP. But if the original message had an aligned DKIM signature and the forwarder didn't modify the email, DKIM passes. DMARC passes on DKIM alignment. The email goes through.
Remailing (the server re-generates and re-sends the message rather than forwarding it): Both SPF and DKIM break. DMARC fails because there's no aligned pass to fall back on. This is where ARC becomes necessary. If the remailing server adds ARC headers documenting what the original authentication looked like, the receiving server can honor those results instead of rejecting the email.
In practice, most simple email aliases (like a catch-all or a personal alias) behave like forwarding. Most mailing lists behave like remailing. The difference matters a lot when your DMARC policy is p=quarantine or p=reject.
You can check how your DMARC policy is configured with our free DMARC parser. If aliases are causing unexpected failures, they'll show up in your DMARC aggregate reports.
Contributors
Who worked on this answer
Every name links to their profile. Every company links to their site. Real people, real accountability.
