← All topicsAuthentication & Verification › Identifier Alignment (SPF/DKIM vs DMARC)
Accuracy / correctness · 2
accuracyHeld the core exact: alignment = passing-auth domain must match the visible From domain. Script keeps the EITHER-OR-BOTH rule verbatim in intent ('DMARC passes if SPF domain matches AND passes, OR DKIM domain matches AND passes; both have to fail before DMARC fails'), matching RFC 7489 and the aiSummary. No drift.
accuracyThe article says SPF 'authenticates the real sender' loosely; the aiSummary is precise that SPF's aligned identifier is the Return-Path/MAIL FROM domain. This intro video deliberately keeps SPF's checked-domain at 'the domain that passed SPF' and defers Return-Path to 003.009.003, which is correct scoping for a definition video. No accuracy loss, just deferral.
Would elevate the video · 1
elevateArticle's phishing frame ('forge From to look like paypal@example.com') is vivid. Script keeps the spoofed-From scenario but swaps to a sea-themed captain@deepcurrent.io per voice rules. Consider naming the impersonation stakes once more explicitly in the description for SEO ('stops email spoofing'). Minor.
Considered, left out · 2
skipArticle mentions the policy actions (quarantine, reject, monitor) inline. Script names DMARC-fail consequence generically and defers policy specifics; policy actions are their own topic (003.003.x / DMARC policy). Correct to skip here to keep one idea per beat.
skipArticle ends on aspf/adkim strictness. Script names both tags and links the strict-vs-relaxed video rather than half-teaching it inline, per the spec's defer-and-link rule. Right call.
DMARC identifier alignment, the lock that ties SPF and DKIM to your From
Question: 003.009.001 · What is identifier alignment in DMARC? · ~3:15 · single-question video
COLD OPEN
DMARC checks if your domains "align." What does that even mean?

DMARC keeps telling you your domains have to "align." Nobody explains what that actually means. Here it is in one line: alignment is DMARC making sure the domain that passed authentication is the same domain the reader sees in the From line.

⬡ dissect, one From address captain@deepcurrent.io, a bracket points to the domain part deepcurrent.io
BEAT 1, the problem alignment solves

Here's the problem. A scammer can type anything into the From header. They can make it say captain@deepcurrent.io while sending from a boat that has nothing to do with you. SPF and DKIM can happily authenticate the scammer's real server. So passing auth, on its own, doesn't prove the email is really from you.

⬡ header-inspector, raw From captain@deepcurrent.io, highlight it, a small "who actually sent this?" flag pops
BEAT 2, what alignment actually checks
Authenticated domain === From domain

Alignment closes that gap. It asks a second question: did the domain that passed SPF or DKIM actually match the From domain? SPF authenticates one domain. DKIM authenticates one domain. Alignment checks each of those against the From line. If neither matches, DMARC fails, even if the auth itself passed.

⬡ auth-flow, two lanes (SPF, DKIM) each running a pass check, then a "match From?" gate on each lane
BEAT 3, either lane is enough

And you don't need both lanes to work. DMARC passes if the SPF domain matches AND passes, OR the DKIM domain matches AND passes. One aligned, passing method is enough. Both have to fail before DMARC fails.

⬡ split-compare, LEFT "SPF: passed + aligned → DMARC pass" vs RIGHT "DKIM: failed alignment" and the verdict lands on pass because one lane held
SUBSCRIBE

If that finally clicked, subscribe. We're walking through every piece of email authentication, one plain question at a time.

⬡ title-card
BEAT 4, why it matters and what you tune

Alignment is the lock that ties everything together. Without it, a scammer could sneak past SPF by spoofing a server, or past DKIM by signing with their own domain. Alignment is what actually stops impersonation. You even control how tight the lock is, with two settings in your DMARC record called aspf and adkim. Strict or relaxed. That's its own video, linked below.

⬡ record-cards, two little cards aspf and adkim, each flipping between "r" and "s"
TAKEAWAY

So identifier alignment is one idea: the domain that passed the check has to be the domain in the From line. That match is what turns "this email is technically valid" into "this email is really from you."

⬡ title-card
NEXT / SUBSCRIBE

Next up, the setting that decides how strict that match has to be: SPF alignment, relaxed versus strict.

⬡ end-card, Subscribe + Next: "SPF alignment, strict vs relaxed" (003.009.002)
DESCRIPTION

DMARC identifier alignment, explained plainly: it's the check that the domain which passed SPF or DKIM is the same domain the reader sees in the From line. We cover why authentication alone doesn't stop spoofing, how alignment closes that gap, and why either SPF or DKIM being aligned and passing is enough for DMARC to pass.

Concepts in this video:

• Identifier alignment → /emailalmanac/authentication-verification/dmarc-alignment-and-auth-flows/what-is-identifier-alignment
• SPF alignment (aspf) → 003.009.002
• DKIM alignment (adkim) → 003.009.004

Next: SPF alignment, strict vs relaxed → [link 003.009.002]

Full written guide → reviewmyemails.com/emailalmanac/authentication-verification/dmarc-alignment-and-auth-flows/what-is-identifier-alignment

#email #DMARC #deliverability

CONNECTIONS
• next: 003.009.002 SPF alignment (strict vs relaxed)
• related: 003.003.001 What is DMARC · 003.009.004 DKIM alignment
• vocab: identifier alignment, From header, aspf, adkim, SPF, DKIM