What DMARC alignment really means
Why SPF or DKIM passing is not enough on its own, how relaxed and strict alignment differ, and a worked example of mail that passes a check but still fails DMARC.
Here is the thing almost everyone gets wrong about DMARC: a green tick on SPF or DKIM does not mean a message passes DMARC. The check also has to line up with the domain your reader sees in the From line. That extra requirement is called alignment, and without it a scammer could pass SPF using their own domain and still forge yours.
The check people think they finished
SPF and DKIM each prove something about a domain. SPF proves the delivering server is authorized for some domain. DKIM proves the message carries a valid signature from some domain. Neither one, on its own, says anything about the domain in the visible From address, which is the only domain your reader actually looks at.
DMARC closes that gap. It says: fine, SPF passed, but for which domain? And does that domain match the From line? If a message shows billing@yourcompany.com in the From line, but the SPF check passed for scammer-server.net, the two do not line up. SPF passed. DMARC still fails. That is alignment doing its job.
So DMARC really asks two questions, not one:
- Did SPF or DKIM pass at all?
- Did the domain that passed match the domain in the From line?
Both have to be yes. One passing check with alignment is enough for DMARC to pass; two passing checks with neither aligned is a failure.
Relaxed versus strict
Alignment comes in two settings, and the difference matters in practice.
Relaxed alignment is the default, and it is the one most people want. It allows a match on the organisational domain, which means subdomains count. If your From line shows news.yourcompany.com and DKIM signed for yourcompany.com, relaxed alignment treats those as the same organization and passes. This is what lets you send from mail.yourcompany.com or news.yourcompany.com without a separate setup for each.
Strict alignment requires an exact match. Under strict alignment, news.yourcompany.com and yourcompany.com are treated as different, and the mail would fail. Strict is tighter, but it is unforgiving of the perfectly normal habit of sending from subdomains, so most senders stay on relaxed unless they have a specific reason.
You set this per check with the aspf tag for SPF and the adkim tag for DKIM. aspf=r and adkim=r mean relaxed (the default if you say nothing), and aspf=s and adkim=s mean strict. A full record might read v=DMARC1; p=reject; adkim=s; aspf=r; rua=mailto:reports@yourcompany.com.
A worked example
This is where it clicks. Say you send your monthly newsletter through a marketing platform. Your customers see hello@yourcompany.com in the From line, exactly as you want.
Behind the scenes, the platform sends the mail from its own infrastructure. The envelope sender, the hidden address that bounces are returned to, is something like bounces@mail.theplatform.com. SPF checks that envelope domain, mail.theplatform.com, against the platform’s own SPF record, and it passes cleanly. The platform runs a tidy operation.
But SPF passed for theplatform.com, and your From line shows yourcompany.com. Those are two different organisational domains. So SPF is not aligned, and as far as DMARC is concerned, the SPF result does nothing for you. This surprises people constantly: “SPF passes, why is DMARC failing?” Because SPF passing for the wrong domain is not SPF passing for you.
Now the fix. You ask the platform to sign your newsletters with DKIM using d=yourcompany.com rather than their own domain. Most reputable platforms support this, usually by having you publish a DNS record they provide. Once that is in place, DKIM passes and the signing domain matches your From line. DKIM is aligned. DMARC passes, and it will keep passing even when the mail is forwarded, because the DKIM signature travels with the message.
Notice what happened: nothing about SPF changed, and it is still unaligned. It did not need to change. DMARC passes if either SPF or DKIM aligns, so getting aligned DKIM in place solved it entirely.
Why this is the crux
Almost every “we set up DMARC but our mail is failing” problem traces back to alignment. The records exist, the checks technically pass, but they pass for a provider’s domain instead of yours. The reports show failure, and the cause is invisible until you know to look at which domain each check passed for.
This is also why you cannot safely jump to p=reject. Until you have confirmed that every legitimate stream of your mail has at least one aligned check, an enforcement policy will block your own newsletters, invoices or booking confirmations along with the forgeries.
Getting it right
The practical work is making the domain that passes match the domain your readers see, for every system that sends on your behalf. That is a short list of concrete steps, which we walk through in get SPF and DKIM aligned so DMARC passes. For the broader picture of how the standard fits together, what is DMARC is the place to start. The one idea to keep: passing a check is not the finish line. Passing a check for your domain is.