Domain alignment is the check in DMARC that the domain authenticated by SPF (the envelope sender) or by DKIM (the d= domain) matches the domain in the From header. Passing SPF or DKIM alone is not enough.
Why it matters
Without alignment, an attacker could pass SPF with their own domain while showing yours in From. DMARC passes when either SPF or DKIM passes and aligns. In relaxed mode (the default) the organisational domain must match, so mail.example.com aligns with example.com; in strict mode, the domains must be identical. You set the mode in the DMARC record with aspf and adkim. Alignment is the usual reason a third-party service passes SPF yet still fails DMARC.
Example
From: hello@example.com
SPF: pass, smtp.mailfrom=bounce.vendor.net -> not aligned
DKIM: pass, d=example.com -> aligned
DMARC: pass (DKIM aligned)The vendor's SPF is irrelevant to alignment, but its DKIM signature uses the customer's own domain, so DMARC passes.
Common mistakes
- Assuming SPF pass means DMARC pass.
- Setting strict alignment without testing subdomains that send mail.
- Not configuring custom DKIM signing at the email service, so it signs with its own domain.
Related
Get notified when this term updates
Plus occasional practical tips on uptime and monitoring, nothing else. Unsubscribe anytime.
This page is general information written by our editorial team and updated when documentation changes. Servers and providers differ, so test changes safely first. See our editorial policy and disclaimer.