Introduction
DMARC alignment is the rule that says: "For a DMARC pass, the domain that authenticated must also match the visible From header." It's the requirement that closes the gap SPF and DKIM leave open.
This article covers how alignment works, the difference between relaxed and strict modes, and which to use.
Why this topic matters
Misunderstanding alignment is the most common cause of "DMARC isn't working" surprises. Senders pass SPF, pass DKIM, and still fail DMARC — because nothing aligns with the From domain.
How alignment works
Two checks happen during DMARC evaluation:
- SPF alignment. Does the SPF envelope-from domain align with the From header?
- DKIM alignment. Does the DKIM signing domain (
d=) align with the From header?
Either qualifies as DMARC-aligned. Both failing means DMARC fails.
Relaxed vs strict — what changes
Relaxed alignment (default for both adkim=r and aspf=r):
The domain just needs to share the organizational domain. mail.brand.com aligns with brand.com; app.brand.com aligns with brand.com.
Strict alignment (adkim=s / aspf=s):
The domain must match exactly. mail.brand.com does NOT align with brand.com in strict mode.
When to use strict
Three scenarios:
- High-stakes financial domain. Strict reduces edge-case attack vectors.
- Single-purpose sending domain. When you control every sender and they all sign with the exact domain.
- Compliance requirement. Some frameworks reference strict alignment.
For most domains, relaxed is the right choice. Strict has more failure modes if misconfigured.
Step-by-step approach to configuring
- Default to relaxed. Don't set
adkimoraspfunless you have a specific reason. - If choosing strict, verify every legitimate sender signs with the exact domain.
- Test on a subdomain first before applying to the parent.
- Monitor aggregate reports for alignment failures.
Best practices
- Stay relaxed unless you have a reason. Cleaner operations.
- Use strict alignment as a hardening step, not a starting state.
- Pair strict with explicit
sp=setting. Subdomains have different alignment needs. - Document any strict choice. Future engineers need the rationale.
- Watch for misalignment in third-party senders. Mailchimp etc. need custom DKIM to align.
Recommended next step
Check your domain's DMARC record. If adkim and aspf aren't explicitly set, you're at relaxed — which is fine for most cases. If they are set to s, verify the rationale.
FAQ
What's the default?
Relaxed (r) for both DKIM and SPF alignment.
Can I use strict on DKIM and relaxed on SPF?
Yes. Each is independently configurable.
Does strict alignment help against attackers?
Marginally. The main attack vectors are addressed by relaxed; strict is hardening.
What about subdomain alignment?
Relaxed alignment treats app.brand.com and brand.com as aligned. Strict treats them as different.
Will strict break legitimate mail?
It can, if your senders sign with a different exact domain. Test before deploying.
Final thoughts
DMARC alignment is the load-bearing piece of the standard. Relaxed mode covers most needs cleanly; strict mode is for specific hardening scenarios.
Default to relaxed, document any strict choice. The operational simplicity is worth it.