Glossary · Email

DMARC Alignment

DMARC alignment requires that the domain authenticated by SPF or DKIM matches the domain in the visible From address.

Updated November 11, 2026

DMARC alignment is the check that the domain validated by SPF (the Return-Path or envelope domain) or by DKIM (the d= domain in the signature) matches the domain in the message's visible From header. DMARC passes if at least one of them both passes and aligns.

Why it matters

SPF and DKIM alone can pass for a domain unrelated to the one the recipient sees. Alignment ties authentication to the From address, which is the one users trust, and that is what blocks spoofing. It is the most common reason mail from a third-party sender, such as a newsletter service, fails DMARC even though SPF and DKIM both show pass.

Example

Alignment can be relaxed (default) or strict, set by adkim and aspf in the policy:

_dmarc.example.com TXT "v=DMARC1; p=quarantine; adkim=r; aspf=r; rua=mailto:dmarc@example.com"

With relaxed alignment, a DKIM signature from d=mail.example.com aligns with a From of news@example.com because they share the organizational domain. With strict, they must match exactly. A signature from d=sender-service.net does not align with either.

Common mistakes

  • Seeing "SPF pass" and assuming DMARC passes.
  • Letting a vendor sign with its own domain instead of setting up a custom DKIM signature for yours.
  • Moving straight to strict mode without reading aggregate reports.

Get notified when this term updates

Plus occasional practical tips on uptime and monitoring, nothing else. Unsubscribe anytime.

Keep reading

Glossary · EmailBIMI (Brand Indicators for Message Identification)BIMI lets a brand display its logo next to authenticated email in supporting inboxes, but only if the domain enforces DMARC.Glossary · EmailDKIM (DomainKeys Identified Mail)DKIM signs outgoing email with a private key and publishes the public key in DNS so receivers can verify the message was not altered.Glossary · EmailDKIM Key RotationDKIM key rotation is the practice of replacing the key pair used to sign outgoing email on a regular schedule while keeping old signatures verifiable during the changeover.Guide · EmailBIMI Explained: Show Your Logo in the Inbox (Requirements and Setup)What BIMI is, what it requires (DMARC enforcement, SVG Tiny PS logo, VMC or CMC certificate), how the DNS record looks, and which mailbox providers display it.6 min readGuide · EmailCheck Your Email Domain Setup (MX, SPF, DKIM, DMARC) in 15 MinutesA beginner's walkthrough to check that your business email domain has the right MX, SPF, DKIM and DMARC records, with free tools and plain-language fixes.7 min readGuide · EmailDKIM Setup and Troubleshooting: Selectors, Key Length, RotationHow DKIM selectors and keys work, how to publish and test a record, choose key length, rotate safely, and diagnose the common reasons dkim=fail shows up.7 min read

This page is general information written by our editorial team and updated when documentation changes. Servers and providers differ, so test changes safely first. See our editorial policy and disclaimer.