DMARC Alignment Explained: SPF vs DKIM, Relaxed vs Strict

The most confusing line in a DMARC report is a message that passed SPF, passed DKIM and still failed DMARC. It isn't a bug. SPF and DKIM prove something about a domain, and DMARC asks a different question: is that the domain the recipient is looking at?

Three domains in every message

• The From domain, in the visible From header. It's what the person sees and what DMARC protects
• The return-path domain, set during the SMTP conversation as the bounce address. SPF is checked against this one
• The DKIM signing domain, written as d= in the DKIM-Signature header. DKIM verifies the signature for this domain

SPF can pass for the return-path domain and DKIM can pass for the d= domain, and neither has to be the From domain. DMARC passes only when at least one of them passes and matches the From domain. That match is alignment.

Relaxed and strict

Alignment has two modes, set separately for SPF (aspf) and DKIM (adkim) in the DMARC record. Relaxed, the default, accepts any subdomain of the same organisational domain: mail from news.example.com aligns with a From of example.com. Strict demands an exact match.

Relaxed is right for almost everyone. Strict is safer on paper and breaks legitimate mail from subdomains and from services that sign with a subdomain, so choose it only after checking every sender.

The typical failures

• A marketing or support platform sends with its own return-path and signs DKIM with its own domain. Both pass, neither aligns, and DMARC fails. The fix is to set up custom DKIM signing with your domain at that service
• SPF passes only because the sender's IP is in your record, but the return-path is the platform's domain. SPF passes without aligning, so rely on DKIM alignment, or configure a custom return-path on your domain
• A mailing list or forwarder rewrites the message and breaks DKIM, and forwarding changes the connecting IP so SPF fails too. That's why DKIM alignment matters more: it survives forwarding when the message is not altered

Why DKIM alignment is the one to get right

SPF alignment depends on the sending path, and any forwarding or relay changes it. A DKIM signature for your own domain travels with the message and stays valid across hops as long as the signed parts aren't edited. Treat aligned DKIM as the primary route to a DMARC pass, and SPF as the backup.

How to check it

Read the Authentication-Results header of a real message, which shows for each mechanism the result and the domain it was evaluated for. Compare those domains with the From address. The header analyzer lays this out in plain English.

Paste headers and see alignment per mechanism

Check your DMARC record and its alignment settings

Roll out enforcement once alignment is clean

Passing SPF and DKIM proves a domain. Alignment proves it's the right one.