DMARC alignment means the domain that passed SPF or DKIM must match the domain in the visible From address. Relaxed alignment accepts any domain sharing the same organizational domain. Strict alignment requires an exact match. Relaxed is the default, and the standard notes nearly all domain owners find it sufficient.
Why alignment exists
SPF validates the envelope sender (MAIL FROM). DKIM validates the domain in the signature's d= tag. Neither looks at the From header that a person sees. An attacker can pass SPF with their own domain while showing yours in From.
DMARC closes the gap by requiring that the authenticated domain align with the From domain. RFC 9989 puts it this way: DMARC requires that identifier alignment be applied to the DKIM identifier because a message can bear a valid signature from any domain, even one used by a bad actor.
The two modes
The aspf tag sets the mode for SPF and adkim sets it for DKIM. Both default to r, relaxed. The value s means strict.
The RFC's own examples, where the From domain is news.example.com:
| Authenticated domain | Relaxed | Strict |
|---|---|---|
| foo.example.com | aligned (same organizational domain, example.com) | not aligned |
| news.example.com | aligned | aligned |
| foo.example.net | not aligned | not aligned |
Details that trip people up
- Only one aligned pass is needed. A message passes DMARC if SPF aligns or DKIM aligns. You do not need both.
- DMARC uses the MAIL FROM identity for SPF. The HELO identity is not used for the DMARC result.
- Multiple DKIM signatures are fine. If any signature aligns with the From domain, DMARC passes. This is how a vendor signature and your own signature coexist.
- Third parties must sign with your domain. A vendor signing with its own d= domain gives a valid signature that does not align with you. Set up the vendor's custom domain signing so the d= value is yours.
- Organizational domain is now found by DNS. RFC 9989 replaced the public suffix list with a DNS tree walk to find it. See the RFC 9989 changes post.
Which should you choose?
Start relaxed. It lets subdomains such as mail.example.com send for example.com without extra work. Move to strict only if you have a specific reason, for example to stop a sibling subdomain run by another team from authenticating as your main domain.
Strict is a tradeoff: it narrows what can pass and raises the chance of breaking a legitimate flow. The RFC adds that publishing explicit DMARC records for every author domain and using strict alignment avoids some interoperability differences between the old and new organizational domain methods.
Quick check
Does SPF pass mean DMARC pass?
No. The SPF domain also has to align with the From domain. A vendor's bounce domain can pass SPF yet fail alignment.
Sources
Last reviewed: 19 October 2026.
