What is DKIM alignment (strict vs. relaxed)?
Still have a question, spotted an error, or have a better explanation or a source we should cite?
You've got DKIM signing working. But then you check your DMARC reports and see alignment failures. What's going on?
DKIM alignment is the check DMARC performs to make sure the domain in your DKIM signature actually matches the domain in your visible From address. Passing DKIM isn't enough on its own. The d= value in the DKIM-Signature header needs to align with your From domain. That's the alignment part.
There are two modes, set using the adkim tag in your DMARC record:
- Relaxed (adkim=r): The organizational domain just needs to match. So if your From is
newsletter@yourbrand.comand your DKIM signs withd=mail.yourbrand.com, that's fine. Same root domain. This is the default and works well for most setups. - Strict (adkim=s): The domains must match exactly.
d=yourbrand.compasses.d=mail.yourbrand.comfails. Most senders don't need this level of restriction.
Where this gets tricky: if you send through a third-party ESP and they sign with their own domain (like d=clicks.youresp.com), that won't align with your From domain under either mode. You'd need to set up custom DKIM signing on your own domain with that ESP to fix it.
Check your current DMARC record's adkim tag with our free Review My Emails DMARC Parser. If the tag is missing, you're already on relaxed mode.
Contributors
Who worked on this answer
Every name links to their profile. Every company links to their site. Real people, real accountability.
