DMARC Alignment
DMARC alignment requires the domain in the visible From header to match (or be a parent/child of) the domain validated by SPF and/or DKIM. Authentication without alignment is not a DMARC pass.
Identifier alignment in plain terms
SPF validates the envelope MAIL FROM / Return-Path domain. DKIM validates the d= domain in the signature. DMARC checks whether those domains align with the RFC5322 From domain.
- Relaxed (r): organizational domain match is enough (mail.example.com aligns with example.com)
- Strict (s): exact domain match required
- aspf controls SPF alignment mode; adkim controls DKIM alignment mode
v=DMARC1; p=none; adkim=r; aspf=r; rua=mailto:[email protected]Common alignment failures
ESP sends with From: [email protected] but DKIM d=esp-mailer.net and SPF Return-Path on a non-aligned bounce domain. Fix by enabling domain alignment / custom DKIM in the ESP, or send from a dedicated subdomain you control.
Forwarding and alignment
Simple forwarding often breaks SPF. DKIM signatures that survive forwarding can still produce a DMARC pass if aligned. Prefer DKIM alignment for brands that rely on mailing lists or forwarding.
How QuickDMARC helps
QuickDMARC highlights sources that authenticate but fail alignment so you can fix ESP settings before enforcement.
Frequently asked questions
Can SPF pass but DMARC fail?
Yes—if SPF passes for a non-aligned Return-Path domain.
Is relaxed or strict better?
Relaxed is the default and usual production choice. Strict is for advanced lockdown after all senders match exactly.
Do I need both SPF and DKIM alignment?
DMARC passes if either aligned SPF or aligned DKIM passes (unless you have additional organizational rules).