/ Glossary — Authentication
What is DMARC alignment?
The rule that makes DMARC effective — the authenticating domain must match your visible From address. It's why a passing SPF or DKIM check isn't always enough. Here's how it works.
/ Definition
Alignment is the rule that makes DMARC effective: it requires that the domain authenticated by SPF or DKIM matches the domain in your visible From address. A message can pass SPF or DKIM for some domain and still fail DMARC if that domain isn't yours — alignment is what closes that gap, ensuring the authentication actually vouches for the address recipients see.
This is why a passing authentication check isn't automatically a passing DMARC result. A third-party tool might send mail that passes SPF for its own domain, but unless that domain aligns with your From address, DMARC fails — which is exactly the exact-domain spoofing DMARC exists to stop. Understanding alignment is the key to fixing the most common DMARC failures.
/ In practice
SPF alignment vs DKIM alignment
Alignment is checked separately for each method, and DMARC passes if either aligns. SPF alignment compares the domain in the Return-Path (the envelope sender SPF checks) against your From domain. DKIM alignment compares the domain in the DKIM signature (the d= tag) against your From domain. Because DKIM survives forwarding while SPF doesn't, DKIM alignment is usually the more reliable path to a consistent DMARC pass — which is why getting every sending source to sign with an aligned key matters so much.
Strict vs relaxed alignment
DMARC supports two alignment modes, set per method. Relaxed alignment — the default — requires only that the organizational domains match, so mail.yourdomain.com aligns with yourdomain.com. Strict alignment requires an exact match, so a subdomain would not align with the parent. Relaxed is right for almost everyone, because it allows the normal use of subdomains for sending while still preventing impersonation by unrelated domains. Strict is reserved for cases needing the tightest possible control. Either way, alignment with your DMARC policy is what turns authentication into anti-spoofing.
/ Fixing alignment
Why third-party senders break alignment
The most common alignment failure comes from third-party sending services. When you send through a CRM, a help desk, or a marketing platform, that service often sends from its own infrastructure with its own domain in the SPF envelope and sometimes its own DKIM signature. The mail passes authentication for the service's domain, but unless that domain aligns with your visible From address, DMARC fails. This is why adding a new tool can suddenly cause DMARC failures for mail that looks perfectly legitimate — the authentication passes, but for the wrong domain.
How to make a sender align
There are two ways to fix it, and the better one is usually DKIM. You can ask the service to sign with a DKIM key on a subdomain of yours — a CNAME setup most reputable platforms support — so the signing domain aligns with your From address. Alternatively, configuring a custom Return-Path on your own subdomain brings SPF into alignment. DKIM alignment is generally preferred because it survives forwarding, where SPF alignment does not. The DMARC aggregate reports tell you which sources are failing alignment, so you can fix them one by one.
Alignment failures are the most common DMARC trap. We design them out.
We make sure every sending source aligns with your From domain so DMARC passes consistently. Bring us your domain and we'll find what isn't aligning.
Book infrastructure reviewRelated capabilities