What domain is checked for DKIM alignment? (d= domain vs From)
Still have a question, spotted an error, or have a better explanation or a source we should cite?
DKIM alignment compares two domains: the d= tag inside your DKIM-Signature header and your visible From header. If they match (or the d= domain is a parent of your From domain in relaxed mode), you've got alignment.
Why does this matter? DKIM alignment is your more reliable path to DMARC success. When you sign mail with your own domain in the d= tag, that signature sticks with the message even if it gets forwarded. SPF alignment, by contrast, often breaks during forwarding because the Return-Path changes. That's why DKIM is the industry standard for ESPs to support.
And Here's the practical angle: if you're getting DMARC failures but your mail still arrives, it's often because DKIM alignment is broken. Your mail passed both SPF and DKIM authentication checks, but the alignment piece didn't line up. Check how SPF, DKIM, and DMARC work together to understand the full picture. See also: SPF alignment.
Contributors
Who worked on this answer
Every name links to their profile. Every company links to their site. Real people, real accountability.
