DMARC alignment means the domain shown in your visible From header has to match the domain that actually passed SPF or DKIM authentication. A message only earns a DMARC pass when at least one of those checks succeeds and the passing domain lines up with what the recipient sees. Two modes govern how strict that match needs to be: relaxed and strict.
TL;DR:
- Use relaxed alignment by default; strict mode requires exact domain matches, so enable it only after reports confirm every legitimate sender and subdomain aligns.
- If an email provider uses its own return path or signing domain, request a custom return path and organizational domain signing before enforcement.
- Publish p=none with aggregate reports, review sources weekly, and move through quarantine to reject only after two to three clean reporting cycles.
- Mailing lists can invalidate DKIM signatures by changing message content, so coordinate with list operators and use organizational domain signing where possible.
Table of Contents
- What DMARC alignment means in protocol terms
- How SPF alignment works (aspf)
- How DKIM alignment works (adkim)
- Strict versus relaxed alignment: which should you choose?
- Common alignment failures and how to fix them
- Setting alignment tags and rolling out your DMARC record safely
- Testing and monitoring alignment through DMARC reports
- How we support organisations working through DMARC alignment
- Book a free health check or advisory session
- FAQ
- Sources
What DMARC alignment means in protocol terms
To understand why that match matters, it helps to separate two things that sit inside every email: the Author Domain and the Authenticated Identifiers. The Author Domain is the domain in the RFC5322.From header, the address your recipient actually sees in their inbox. The Authenticated Identifiers are different: the RFC5321.MailFrom (the envelope sender, sometimes called the return-path) that SPF checks, and the d= domain that DKIM uses when it signs a message.
DMARC itself doesn’t authenticate anything. It sits on top of SPF and DKIM and asks a single question: did at least one of these pass, and if so, does the domain that passed match the Author Domain closely enough? That second part is alignment, and it’s what stops a message from passing SPF or DKIM on some unrelated domain while still displaying your brand’s address to the recipient. The DMARC bis draft sets this out as central to the mechanism: identifier alignment, not authentication alone, is what DMARC is built to enforce. Without it, a message could technically authenticate and still spoof the sender identity your recipients trust.
How SPF alignment works (aspf)
SPF alignment compares the domain in your RFC5321.MailFrom, the return-path, against the domain in your visible From header. SPF itself only ever validates the return-path domain against the sending IP address; DMARC is what then asks whether that validated domain is close enough to what the recipient sees.
The aspf tag in your DMARC record decides how close is close enough. Set it to r (relaxed, and the default) and a return-path of mail.yourdomain.co.uk will align happily with a From header of yourdomain.co.uk, because they share the same organisational domain. Set it to s (strict) and only an exact match passes: mail.yourdomain.co.uk against yourdomain.co.uk would fail under strict SPF alignment, full stop.
In practice, this is where a lot of SPF setups quietly fall over. Many ESPs send using their own return-path domain by default, which breaks alignment entirely unless you’ve configured a custom one. The fix is usually straightforward: ask your provider for a custom return-path (sometimes called a custom MAIL FROM or bounce domain) on a subdomain you control, and verify it resolves correctly before you rely on it.
How DKIM alignment works (adkim)
DKIM alignment works on a similar principle but with a different identifier. Instead of the return-path, DMARC checks the d= tag in your DKIM signature, the domain that actually signed the message, against the From header domain.
The adkim tag controls the matching rule here too. Relaxed (r) allows the signing domain and the From domain to share an organisational domain, so a signature from mail.yourdomain.co.uk still aligns with a From header of yourdomain.co.uk. Strict (s) demands an identical match between the two.
DKIM alignment tends to be more resilient than SPF to the usual hazards of email transit, because the signature travels with the message rather than depending on the originating IP address. That said, it can still break when a message is modified in transit, such as when a mailing list adds a footer or rewrites the subject line, which invalidates the signature entirely. The practical fix most administrators settle on is organisational signing: sign with your top-level domain rather than a narrow subdomain, use a dedicated selector per sending platform so you can tell sources apart in reports, and coordinate with any mailing list or forwarding service that might touch message content before it reaches the recipient.
Strict versus relaxed alignment: which should you choose?
Relaxed alignment accepts a match at the organisational domain level, so mail.yourdomain.co.uk and yourdomain.co.uk count as aligned for either SPF or DKIM. Strict alignment demands an exact, identical match on the fully qualified domain name, nothing broader.
A couple of examples make the difference concrete. Under relaxed aspf, a return-path of bounce.yourdomain.co.uk aligns with a From header of yourdomain.co.uk. Under strict aspf, that same pair fails, because bounce.yourdomain.co.uk isn’t identical to yourdomain.co.uk. The same logic applies to adkim with the DKIM signing domain in place of the return-path.
Deciding between the two usually comes down to a handful of practical questions:
- How much control do you have over every subdomain that sends mail on your behalf?
- Do you rely on third-party senders or ESPs that sign or route mail through their own infrastructure?
- Are you using multiple subdomains deliberately for different business units or campaigns?
- Have you already run DMARC reports long enough to be confident nothing legitimate will break?
The DMARC bis draft notes that relaxed alignment is sufficient for most domain owners in practice, while strict alignment offers stronger protection against spoofing when you genuinely control every sending domain and subdomain involved. The sensible path is to monitor first under relaxed settings, confirm your legitimate sources all pass cleanly, and only tighten to strict once you’re certain nothing will be caught in the crossfire.
Common alignment failures and how to fix them
Most alignment failures trace back to one of three scenarios, and each has a reasonably well-understood fix.
- Forwarding breaks SPF. When a message is forwarded, the receiving server sees a return-path that doesn’t match the original sending domain, so SPF alignment fails even though the message is legitimate. ARC (Authenticated Received Chain) helps receiving mail systems recognise legitimate forwarding, and choosing a bounce domain you control reduces unnecessary failures elsewhere.
- Mailing lists break DKIM. Any list that adds a footer, alters the subject line, or rewraps content invalidates the original DKIM signature. Coordinating with the list operator, and signing at the organisational domain rather than a narrow subdomain, gives you the best chance of staying aligned.
- Third-party senders send unaligned mail. Many platforms use their own default return-path and signing domain rather than yours. Ask for an aligned, custom return-path, or delegate a dedicated bounce subdomain to that vendor, and keep a record of exactly which DNS entries each vendor requires.
For urgent failures, the quickest remediation checklist is: identify the failing source from your aggregate reports, confirm whether it’s SPF, DKIM or both that’s misaligned, request or configure a custom return-path and signing domain with that sender, and recheck reports after a few days before tightening policy further.
Setting alignment tags and rolling out your DMARC record safely
Alignment is set directly in your DMARC TXT record using the aspf and adkim tags, each taking a value of r (relaxed) or s (strict). A monitoring-stage record typically looks like this:
v=DMARC1; p=none; rua=mailto:reports@yourdomain.co.uk; aspf=r; adkim=r
As confidence grows, policy tightens in stages rather than jumping straight to enforcement:
- Stage one:
p=nonewith both tags relaxed, purely for visibility while you inventory every sending source. - Stage two:
p=quarantineonce your legitimate senders are consistently passing aligned. - Stage three:
p=reject, and only then consider moving aspf or adkim to strict if every sender is fully under your control.
A practical rollout follows roughly this order: inventory every system and vendor that sends mail using your domain, add or correct SPF records and DKIM signing for each one, publish p=none with an rua address so reports start arriving, read those reports carefully for several weeks, then tighten policy and alignment mode only once the legitimate sources are clean.
Pro Tip: Keep DKIM selectors short and specific to each sending platform (for example, selector ‘esp1’ versus ‘esp2’), and keep DNS TTLs modest during rollout so changes propagate quickly if something needs correcting.
A small technical note worth flagging: DKIM key length matters for long-term security, and most current guidance favours 2048-bit keys over the older 1024-bit default where your signing platform supports it.
Testing and monitoring alignment through DMARC reports
DMARC aggregate reports (the rua feed) are where alignment problems actually surface. Each report breaks down, by sending source, whether SPF and DKIM passed and whether each one aligned, which lets you see precisely which vendors or systems need attention rather than guessing.
A sensible monitoring routine looks like this:
- Review aggregate reports weekly while still on
p=none, checking each source for alignment pass or fail rather than just raw authentication results. - Use a DMARC report parser or dashboard, since raw XML reports are not practical to read by eye at any scale.
- Check Gmail’s sender guidelines, which require bulk senders to configure SPF and DKIM with alignment to either organisational domain, as a working benchmark for what major mailbox providers expect.
- Reserve forensic reports (ruf) for specific investigations, since they can contain message content and carry privacy considerations that aggregate reports avoid.
- Treat a policy change as successful once your legitimate sources show consistent aligned passes across at least two to three reporting cycles before tightening further.
How we support organisations working through DMARC alignment
Getting SPF and DKIM configured correctly across every sending platform, and then aligning them without breaking legitimate mail, is often more fiddly in practice than the specification suggests, particularly once multiple vendors and subdomains are involved. Support is available to work with marketing, IT and engineering teams to handle authentication setup, interpret DMARC reports, and move domains through monitoring to enforcement without disrupting delivery.
We offer assistance with authentication setup across SPF, DKIM and DMARC, ongoing reputation monitoring once policy is enforced, support with ESP migration when a sending platform changes, and remediation when alignment failures have started affecting inbox placement. We also support DMARC monitoring and setup as an ongoing service rather than a one-off fix, which matters once multiple vendors are sending on your behalf.
If you’ve already published a monitoring-only record and are seeing consistent failures you can’t trace, that’s usually the point where bringing in a second pair of eyes saves more time than continuing to dig alone.
Book a free health check or advisory session
If your DMARC reports are showing alignment failures you can’t quite pin down, or you’re ready to move from monitoring towards enforcement but want a second opinion first, our deliverability services cover exactly this ground: authentication setup, remediation and ongoing reputation monitoring, delivered directly by a senior specialist rather than handed off to a support queue.
We offer a free health check as the natural starting point, and for teams who just need focused technical input, a one-off advisory session at £250 gives you direct access to work through your specific configuration. Book a free health check to find out where your alignment currently stands.
FAQ
How do you set up DMARC correctly?
Start by publishing SPF and DKIM for every legitimate sending source, then publish a DMARC record at p=none with an rua address so you receive aggregate reports. Review those reports to confirm your genuine senders pass aligned, then move policy through p=quarantine to p=reject in stages.
Can you explain DMARC in simple terms?
DMARC checks whether the domain a recipient sees in the From header matches the domain that passed SPF or DKIM, and tells receiving mail servers what to do if it doesn’t, whether that’s nothing, quarantine, or rejection. It relies on SPF and DKIM for the actual authentication and adds the alignment check and reporting on top.
What is the difference between alignment and authentication?
Authentication is SPF or DKIM independently confirming that a message came from a server or domain authorised to send it. Alignment is the separate check DMARC performs afterwards, confirming that the domain which passed authentication actually matches the visible From header, which is what stops a technically valid but spoofed sender identity from passing.
What does it mean when DKIM is not aligned?
It means the d= domain in the DKIM signature doesn’t match the From header domain closely enough for the alignment mode you’ve set, often because a third-party platform signed with its own domain rather than yours, or because a mailing list modified the message and invalidated the signature. Fixing it usually means requesting organisational-domain signing from the sending platform or coordinating with the intermediary altering the message.
Does DMARC alignment affect BIMI?
Yes, BIMI (Brand Indicators for Message Identification) requires a DMARC policy of at least p=quarantine enforced with consistent aligned passes before a brand logo can display in supporting inboxes. Reliable alignment is effectively a prerequisite for BIMI eligibility, not an optional extra.
