What is DMARC alignment?

Two modes exist. Relaxed alignment accepts any subdomain of the organizational domain, so mail.yourdomain.com aligns with yourdomain.com. Strict alignment demands an exact match.

Only one of the two authentication paths needs to align for DMARC to pass. That redundancy is deliberate: forwarding usually breaks SPF while leaving the DKIM signature intact.

The common failure is a platform sending with its own return path. SPF passes for their domain, DKIM signs with their domain, and both fail alignment because your From header says something else.

The fix is the same in both directions: authenticate with your own domain. Set up a custom return path and a DKIM key on your domain inside the platform, and both paths align.

Say Acme sends invoices through a billing platform it hasn't fully set up. A customer opens one in Gmail, clicks Show original, and sees this line: Authentication-Results: mx.google.com; dkim=pass header.i=@billingtool.example; spf=pass smtp.mailfrom=bounces.billingtool.example; dmarc=fail header.from=acme.example.

Read it left to right, the way you would if this were your own domain. DKIM passed, but for the platform's domain. SPF passed as well, for the platform's bounce domain. Then DMARC compared each of those domains with acme.example in the From line, found no match on either path, and failed the message.

After Acme adds the platform's DKIM key under its own domain, the same header shows header.i=@acme.example and dmarc=pass. SPF can stay unaligned and it won't matter, which saves you a DNS change. Messages are also allowed to carry two DKIM signatures, one from the platform and one from you, and a single aligned one is enough.

Relaxed alignment compares organizational domains, and receivers work those out from the Public Suffix List. For mail.acme.co.uk the list says co.uk is a public suffix, so the organizational domain is acme.co.uk. That's why billing.acme.co.uk aligns with acme.co.uk, and why acme.co.uk never aligns with other.co.uk even though they share an ending.

You choose the mode per path. The adkim tag controls DKIM and aspf controls SPF, each set to r for relaxed or s for strict. Leave them out and both default to relaxed.

Strict mode catches people who send from subdomains. With aspf=s, a return path at bounces.acme.example no longer aligns with a From address at acme.example, because the two strings aren't identical. Before you tighten either tag, look at a week of aggregate reports and count how much of your passing mail relies on a subdomain match.