DMARC alignment is the part of email authentication that most often confuses people. SPF passes. DKIM passes. Yet the DMARC report says fail. The cause is nearly always alignment: DMARC does not only ask whether SPF and DKIM succeeded, it asks whether they succeeded for the domain that the recipient sees in the From address. This guide explains the rule, the relaxed and strict modes and how to diagnose and fix a misaligned message.
Three domains in one message
A single email carries several domain names that people often treat as one. DMARC compares them.
| Name | Where it is found | Used by | Seen by the reader? |
|---|---|---|---|
| From domain | The From header | DMARC reference point | Yes |
| Return-Path domain (envelope sender) | The MAIL FROM address, recorded as Return-Path | SPF | Normally no |
| DKIM signing domain | The d= tag in the DKIM-Signature header | DKIM | No |
SPF authenticates the Return-Path domain, not the From domain. DKIM authenticates whichever domain signed the message. Without alignment, a third party could pass SPF and DKIM for its own domain while putting your domain in the From line, and the reader would never notice. Alignment closes that gap. For the basics of each protocol, see authenticating a sending domain.
The DMARC rule in one sentence
DMARC passes when SPF passes and the SPF domain aligns with the From domain, or DKIM passes and the DKIM domain aligns with the From domain.
| SPF | DKIM | DMARC |
|---|---|---|
| Pass and aligned | Any | Pass |
| Any | Pass and aligned | Pass |
| Pass but not aligned | Pass but not aligned | Fail |
| Pass but not aligned | Fail or missing | Fail |
| Fail | Pass but not aligned | Fail |
| Fail | Fail | Fail |
Relaxed and strict alignment
A DMARC record can set the comparison mode for each protocol with the aspf and adkim tags. The default for both is relaxed.
| Mode | Tag value | Rule | Example: From is example.com |
|---|---|---|---|
| Relaxed | r (default) | Same organizational domain | Return-Path bounce.example.com aligns; DKIM d=mail.example.com aligns |
| Strict | s | Exactly the same domain | bounce.example.com does not align; only example.com does |
_dmarc.example.com. IN TXT "v=DMARC1; p=none; rua=mailto:dmarc@example.com; aspf=r; adkim=r"The organizational domain is the registered name directly under a public suffix. For mail.example.com it is example.com, and for shop.example.co.uk it is example.co.uk. Receivers use the public suffix list to compute it, so you cannot work it out by counting dots.
Choose strict mode with care. Strict alignment can reject legitimate mail from subdomains and from services that sign with a subdomain. Most senders stay with relaxed, which still stops spoofing of the exact organizational domain.
Why SPF is the usual culprit
When you send through a sending platform, the platform normally controls the envelope sender so that it can receive bounces. By default, that address is on the platform own domain, for example bounces.platform.example. SPF checks that domain, finds the platform sending IP in its record and passes. But the domain is not yours, so SPF is not aligned with your From domain and does not help DMARC.
From: orders@example.com
Return-Path: bounce-1234@bounces.platform.example <- SPF checks this domain
DKIM d=: platform.example <- signed by the platform
SPF: pass (platform.example) not aligned
DKIM: pass (platform.example) not aligned
DMARC: failThe example uses placeholder names. The fix is to give the platform your own domain for these roles, which is what verifying a sending domain does. Follow verifying your sending domain and custom return-path and tracking domains.
Why DKIM alignment matters most
SPF has a structural weakness: when mail is forwarded, the forwarding server sends it from its own IP address, which your SPF record does not list. SPF then fails or no longer aligns. A DKIM signature, however, travels inside the message and usually survives forwarding unchanged. If that signature uses your own domain, DMARC can still pass. That is why most guidance says to aim for aligned DKIM first and aligned SPF as a second layer. Our guide to DKIM selectors and key rotation covers keeping that signature healthy.
How to diagnose a failure
- Send a test message Send to a mailbox you control, ideally at a large provider that shows full headers.
- Open the original message Look at the Authentication-Results header. Our guide to reading email headers explains it.
- Read the three domains Note the From domain, the smtp.mailfrom (Return-Path) domain in the SPF result and the header.d domain in the DKIM result.
- Compare For each protocol, ask whether the domain equals the From domain or shares its organizational domain.
- Fix the side that is easiest Usually publish the DKIM record and set the custom return-path domain with your platform.
- Repeat and watch reports Aggregate reports will show other sources that still fail. See DMARC aggregate reports.
Typical findings
| What you see | Meaning | Fix |
|---|---|---|
| spf=pass with smtp.mailfrom on a platform domain | SPF passes but is not aligned | Set a custom return-path under your domain |
| dkim=pass with header.d on a platform domain | DKIM passes but is not aligned | Publish the DKIM record for your domain and sign with it |
| dkim=none | No signature present | Enable DKIM signing for your domain |
| spf=fail on forwarded mail | Forwarder IP not in your SPF | Rely on aligned DKIM |
| dmarc=fail only for a subdomain | Mode or policy mismatch | Check aspf, adkim and the sp tag |
A worked example: marketing mail failing while receipts pass
A company sends receipts from its own application servers and newsletters through a separate tool. Aggregate reports show the receipts passing DMARC and the newsletters failing, even though the newsletter tool reports SPF and DKIM as passing. The team opens a newsletter header. The From domain is example.com. The Return-Path is on the tool domain, and the DKIM signature is also from the tool domain. Both pass, and neither aligns.
They follow the tool domain setup: publish the two DKIM records it supplies, and a CNAME for a custom return-path under mail.example.com. A new test shows the DKIM signing domain as example.com and the return-path domain as mail.example.com. Under relaxed alignment, both align with the From domain. The next aggregate report shows the newsletters passing. The example is illustrative, with placeholder names, but this exact pattern is among the most frequent DMARC problems.
Alignment and subdomains
- A DMARC record on the organizational domain applies to subdomains unless you add an sp tag for a different subdomain policy.
- Using a subdomain such as mail.example.com for sending is fine under relaxed alignment, because it shares the organizational domain with example.com.
- Separate streams on separate subdomains each need their own DKIM records and return-path setup. See separating transactional and marketing streams.
- Domains you never send from should have a restrictive record, so that spoofing them is rejected.
Checking every sender before you tighten the policy
Alignment problems are rarely limited to one tool. Most organisations have a long tail of systems that send as their domain: a billing application, a helpdesk, a CRM, a survey tool, an HR system and the occasional forgotten script. Each one has its own envelope sender and its own DKIM signature, and each must align before you move from a monitoring policy to quarantine or reject. Keep a simple inventory with one row per sender and four columns: the system, the Return-Path domain it uses, the DKIM domain it signs with and whether DMARC passes in recent reports. Anything with a failing row either needs a configuration fix or should stop sending as your domain. Only when the inventory is clean should you raise the policy, and then do it in steps while watching the reports.
What alignment does not do
Alignment shows that a message is tied to the domain in the From address. It does not show that the content is honest, and it does not stop a fraudster using a similar-looking domain they own and authenticate correctly. It also does not help when a legitimate mailbox is compromised. Treat DMARC as one important layer, and read about its limits in our guide to bulk sender requirements, which explains why large providers now expect it.
DMARC still failing after the steps above? Send us a header from a failing message and we will help you read it.
Further reading and sources
Frequently asked questions
What is DMARC alignment?
It is the requirement that the domain authenticated by SPF or DKIM matches the domain in the visible From address. DMARC passes only if at least one of the two passes authentication and is aligned with the From domain.
Why does my message pass SPF but fail DMARC?
SPF checks the envelope sender domain, also called the Return-Path or bounce domain. If a sending service uses its own domain there, SPF passes for that domain but is not aligned with your From domain, so it does not count for DMARC.
What is the difference between relaxed and strict alignment?
In relaxed mode, the two domains only need to share the same organizational domain, so mail.example.com aligns with example.com. In strict mode they must be exactly equal. Relaxed is the default for both SPF and DKIM.
Do I need both SPF and DKIM to align?
No. DMARC needs only one of them to pass with alignment. In practice it is best to align both, because forwarding often breaks SPF and DKIM then carries the result.
What is an organizational domain?
The registered domain one level below a public suffix. For mail.example.com it is example.com. For shop.example.co.uk it is example.co.uk. Receivers use a public suffix list to work this out.
How do I make SPF align?
Use a custom return-path domain under your own domain, so that the envelope sender is on a domain that matches your From domain. Your sending platform provides the records. See our guide on custom return-path and tracking domains.
How do I make DKIM align?
Sign messages with a key published on your own domain, so that the d= value matches your From domain or shares its organizational domain. Platforms usually give you a DKIM record to publish.
Should I use strict alignment?
Only if you have a reason and understand the effect. Strict mode can break legitimate mail from subdomains. Most senders keep relaxed, which still protects against spoofing of the exact organizational domain.
Does alignment affect forwarded mail?
Yes. Simple forwarding often breaks SPF because the forwarder is not in your SPF record. If DKIM is aligned and survives, DMARC can still pass. This is a main reason to align DKIM.