What Is DMARC Alignment? Relaxed vs Strict, With Examples

DMARC alignment means the domain in your visible From address matches the domain that passed SPF or DKIM. A message passes DMARC only when at least one of those checks both passes and aligns, which is why mail can show spf=pass and dkim=pass and still fail DMARC.

The three domains in every email

Every message carries more than one domain, and they do not have to match:

Where	What it is	Checked by
From header	The address recipients see	DMARC (the domain everything is compared to)
Return-path (envelope sender)	Where bounces go	SPF
DKIM signature d= tag	The domain that signed the message	DKIM

SPF asks: is this server allowed to send for the return-path domain? DKIM asks: is this signature valid for the d= domain? Neither one looks at the From address. DMARC adds that missing link by requiring one of them to match the From domain.

Relaxed vs strict alignment

DMARC records can set alignment mode separately for SPF (aspf) and DKIM (adkim).

Mode	Tag value	Rule	Example that passes
Relaxed (default)	r	Same organisational domain	From example.com, DKIM d=mail.example.com
Strict	s	Exact same domain	From example.com, DKIM d=example.com only

Most senders should leave alignment relaxed. It lets you use subdomains for different sending services, such as news.example.com for marketing, while still passing DMARC for example.com. Strict alignment is mainly for organisations that want to stop subdomains from being used to pass DMARC for the main domain.

Worked examples

Example 1: Passing. From is [email protected]. The email platform signs DKIM with d=example.com after you added its DKIM records to your DNS. DKIM passes and aligns. DMARC passes, whatever SPF does.

Example 2: Failing despite passes. From is [email protected]. The platform signs with d=platformmail.net and uses a return-path at bounces.platformmail.net. SPF passes for the platform's domain. DKIM passes for the platform's domain. Neither aligns with example.com. DMARC fails.

Example 3: Relaxed subdomain. From is [email protected]. The return-path is bounce.example.com and SPF passes for it. With relaxed SPF alignment, that aligns. DMARC passes.

How to check alignment on a real message

1. Send a test to a Gmail account and open "Show original".
2. Look at the Authentication-Results line for spf=pass, dkim=pass and dmarc=pass.
3. Compare the smtp.mailfrom domain (SPF) and the header.d or header.i domain (DKIM) with the From domain.

If DMARC fails, the domains in step 3 will not match your From domain. Email headers explained walks through reading the full header.

You can also read your DMARC aggregate reports, which show alignment results for every source sending as your domain. The DMARC report analyzer turns the XML into a readable table.

How to fix alignment

For every service that sends as your domain (your mailbox provider, marketing platform, CRM, help desk, invoicing tool):

• Set up custom DKIM. Most platforms give you two or three CNAME or TXT records so they can sign with your domain. This is the most important step. See the DKIM glossary entry for how signing works.
• Set a custom return-path if offered. Often called a custom bounce domain or custom MAIL FROM. This makes SPF align as well.
• Keep SPF under 10 lookups if you add services to it; the SPF lookup counter checks.

Then confirm the DNS side with the DMARC checker and DKIM checker.

Common alignment problems by sender type

Sender	Typical problem	Fix
Google Workspace or Microsoft 365	DKIM never enabled for the domain	Turn on DKIM in the admin console and publish the key
Marketing platform	Signs with its own shared domain	Authenticate your domain in the platform's settings
CRM sending sales email	Uses a generic return-path	Add the CRM's DKIM records; set custom return-path if available
Help desk or invoicing tool	Sends as your domain without any setup	Add its DKIM records or send from a subdomain set up for it
Forwarded mail	SPF breaks when the forwarder resends it	Rely on aligned DKIM, which survives forwarding

Forwarding is worth a note. When a message is forwarded, the forwarding server becomes the sender, so SPF usually fails for your domain. DKIM signatures survive as long as the message is not modified. That is why aligning DKIM matters more than aligning SPF. ARC exists to help receivers trust forwarded mail that has lost its original authentication.

Moving to a stricter policy safely

Alignment problems are why DMARC policies start at p=none. With p=none, receivers report failures but do not act on them. Watch the aggregate reports until every legitimate sender is aligned, then move to p=quarantine and later p=reject. Jumping straight to reject while one service is still unaligned will send that service's mail to spam or block it. Moving DMARC from none to reject describes the steps.

Why alignment matters more now

Gmail and Yahoo require bulk senders to pass DMARC with alignment, and Microsoft applies similar rules to high-volume senders to Outlook.com addresses. Messages that fail can be filtered or rejected. Even small senders benefit, because aligned mail is easier for providers to attribute to your domain's reputation. Gmail and Yahoo bulk sender requirements has the full list.

Quick glossary

• Organisational domain: the registered domain, such as example.com for mail.example.com.
• aspf and adkim: DMARC tags that set SPF and DKIM alignment mode, relaxed (r) or strict (s).
• d= tag: the domain that signed a DKIM signature.
• smtp.mailfrom: the return-path domain that SPF checked, shown in authentication results.

Alignment and list quality

Alignment tells mailbox providers the mail really comes from you. That means your reputation, good or bad, follows every message. High bounce rates from unverified lists then count directly against your domain. Verifying addresses before you send keeps that reputation clean: upload a list on the verify page and you get 100 free email checks when you sign in with Google, no card.