DMARC alignment checker: do SPF and DKIM match your From domain?
DMARC passes when SPF or DKIM passes and its domain aligns with the From domain. Aligned means the same registrable domain in relaxed mode, or the exact same domain in strict mode. Enter the From, Return-Path and DKIM d= domains, or paste message headers, and this checker shows which method aligns and whether DMARC passes.
By SimpleVerifier Team · Last updated · Runs in your browser; nothing you paste is sent to us
How do I check DMARC alignment?
- Open a received message's full headers and paste them in, then press Read the headers. Or type the From domain, the Return-Path domain and the DKIM d= domain by hand.
- Set aspf and adkim to match your DMARC record: relaxed is the default, strict needs an exact domain match.
- Tick whether SPF and DKIM passed in the Authentication-Results header.
- Press Check alignment and read which method aligns.
- If DMARC fails, sign with your own domain from your sending service so DKIM aligns with the From domain.
What is DMARC alignment?
DMARC adds one rule to SPF and DKIM: the domain they authenticate must match the domain in the visible From address. Under RFC 7489, in relaxed mode the two need the same Organizational Domain, so mail.example.com aligns with example.com. In strict mode only an exact match counts.
A message passes DMARC if at least one method both passes and aligns. SPF checks the Return-Path (envelope) domain, not the From domain, and DKIM checks the d= domain of the signature. If your sending service uses its own domain for both, SPF and DKIM pass and DMARC still fails. Our guide to DMARC alignment has worked examples.
Why does DMARC fail when SPF and DKIM both pass?
Because neither passing result is for your domain. Typical case: you send through a bulk email platform. The platform's servers are authorised in its own SPF record for its own return-path domain, and it signs with its own d= domain. Both checks pass, but neither domain matches your From domain, so alignment fails.
The usual fix is a custom DKIM setup, where the platform signs with a key published under your domain. Then DKIM passes and aligns, and DMARC passes even if SPF does not align. A DKIM check confirms the key is published; the DMARC checker shows your policy.
Should I use strict or relaxed alignment?
Relaxed is the default and is right for most senders, because it lets mail from subdomains such as news.example.com align with example.com. Strict, set with aspf=s or adkim=s, is for senders who want to refuse any subdomain mismatch. It breaks mail from subdomains you didn't plan for, so test before you switch.
Relaxed versus strict alignment
| From domain | Authenticated domain | Relaxed | Strict |
|---|---|---|---|
| example.com | example.com | Aligned | Aligned |
| example.com | mail.example.com | Aligned | Not aligned |
| news.example.com | example.com | Aligned | Not aligned |
| example.com | mailer-service.net | Not aligned | Not aligned |
Who uses this tool, and for what?
- Email admins
- Work out why a rollout to
p=rejectwould block a legitimate sender. - Agencies
- Prove to a client which of their sending services signs with their domain and which doesn't.
- Marketers
- Check a new email platform is set up to pass DMARC before the first campaign.
- Developers
- Debug a transactional sender that passes SPF and DKIM but still lands in spam.
What can’t this tool tell you?
- It works from what you enter. It does not fetch your DNS or your DMARC record; the DMARC checker does that.
- The registrable domain is estimated without the full Public Suffix List, so unusual suffixes can differ from a receiver's result.
- Receivers also apply their own filtering. A DMARC pass does not guarantee inbox placement.
- The headers reader uses the first matching header lines; read multi-hop messages by hand.
Common questions
- What does DMARC alignment mean?
- The domain that SPF or DKIM authenticated must match the domain in the visible From address. Relaxed alignment accepts the same registrable domain; strict needs an exact match.
- Does DMARC need both SPF and DKIM to align?
- No. One aligned and passing method is enough.
- Why is SPF aligned but not DKIM?
- Your Return-Path domain matches the From domain, but the signature's d= domain is the sending platform's. Setting up custom DKIM at the platform makes DKIM align too.
- What is the default DMARC alignment mode?
- Relaxed, for both SPF (aspf) and DKIM (adkim), when the tags are missing from the record.
- Are the headers I paste sent anywhere?
- No. Everything runs in your browser.
Sources
Authentication and capacity are half of deliverability.
The other half is who you send to. Every hard bounce counts against the domain and inboxes you are sending from, and nothing in DNS can tell you which addresses on your list are dead.
- Bulk verification with real SMTP mailbox checks
- Hard bounces removed before a send, not discovered after
- Catch-all, disposable and role detection on every row
One plan, cancel anytime, no contract. Sign in with Google and your first 100 email checks are free, no card. The free tools stay free either way.