Why Alignment Matters
DMARC exists to prevent domain spoofing. Alignment connects authentication to the domain recipients actually see.
Without Alignment
Attackers could:
- Send from their own authenticated domain
- Put your domain in the visible From header
- Pass SPF and DKIM with their domain
- Recipients see your domain, trust the email
With Alignment
Alignment prevents this by requiring the authenticated domain to match the From domain. Attackers cannot authenticate as your domain without your keys.
SPF Alignment
SPF alignment compares two domains:
- From domain: The domain in the visible From: header
- Return-Path domain: The domain in the envelope sender (MAIL FROM)
For SPF alignment to pass, these domains must match (according to relaxed or strict rules).
Example
From: [email protected]
Return-Path: [email protected]
SPF passes for yourdomain.com. Alignment: Both are yourdomain.com = aligned.
DKIM Alignment
DKIM alignment compares:
- From domain: The domain in the visible From: header
- DKIM d= domain: The domain in the DKIM signature
For DKIM alignment to pass, these domains must match.
Example
From: [email protected]
DKIM-Signature: d=yourdomain.com
DKIM signature valid. Alignment: Both are yourdomain.com = aligned.
Only One Needs to Align
DMARC passes if either SPF or DKIM both passes and aligns. You do not need both to align—just one successful aligned authentication is sufficient.
Relaxed vs Strict Alignment
DMARC allows two alignment modes, specified in your DMARC record.
Relaxed Alignment (Default)
Organizational domain match is sufficient:
- From: [email protected]
- SPF/DKIM: yourdomain.com
- Result: Aligned (same organizational domain)
DMARC record: aspf=r (relaxed SPF), adkim=r (relaxed DKIM)
Strict Alignment
Exact domain match required:
- From: [email protected]
- SPF/DKIM: yourdomain.com
- Result: NOT aligned (mail.yourdomain.com ≠ yourdomain.com)
DMARC record: aspf=s (strict SPF), adkim=s (strict DKIM)
Which to Use
- Relaxed (recommended for most): Allows subdomains to align with parent domain
- Strict: Maximum security but requires exact domain matching throughout
Common Alignment Problems
Third-Party Sending Services
When using email service providers:
- They may use their domain for Return-Path (SPF fails alignment)
- They may sign with their domain (DKIM fails alignment)
- Solution: Configure custom Return-Path and DKIM with your domain
Subdomain Mismatches
With strict alignment:
- Sending from mail.yourdomain.com
- DKIM signed as yourdomain.com
- Fails strict alignment (requires switching to relaxed)
Multiple Email Services
Each service needs proper alignment configuration:
- Add each service to SPF
- Configure custom DKIM for each
- Ensure Return-Path uses your domain
Checking Alignment
Email Headers
Look for Authentication-Results header:
dmarc=passmeans alignment succeededdmarc=failcheck spf= and dkim= for pass but alignment failed
DMARC Reports
Aggregate reports show alignment status for each source. Failed alignment appears even when SPF/DKIM pass.