DMARC alignment is the check that the domain validated by SPF (the Return-Path or envelope domain) or by DKIM (the d= domain in the signature) matches the domain in the message's visible From header. DMARC passes if at least one of them both passes and aligns.
Why it matters
SPF and DKIM alone can pass for a domain unrelated to the one the recipient sees. Alignment ties authentication to the From address, which is the one users trust, and that is what blocks spoofing. It is the most common reason mail from a third-party sender, such as a newsletter service, fails DMARC even though SPF and DKIM both show pass.
Example
Alignment can be relaxed (default) or strict, set by adkim and aspf in the policy:
_dmarc.example.com TXT "v=DMARC1; p=quarantine; adkim=r; aspf=r; rua=mailto:dmarc@example.com"With relaxed alignment, a DKIM signature from d=mail.example.com aligns with a From of news@example.com because they share the organizational domain. With strict, they must match exactly. A signature from d=sender-service.net does not align with either.
Common mistakes
- Seeing "SPF pass" and assuming DMARC passes.
- Letting a vendor sign with its own domain instead of setting up a custom DKIM signature for yours.
- Moving straight to strict mode without reading aggregate reports.
Related
Get notified when this term updates
Plus occasional practical tips on uptime and monitoring, nothing else. Unsubscribe anytime.
यह पेज सामान्य जानकारी है, जिसे हमारी संपादकीय टीम ने लिखा है और दस्तावेज़ीकरण बदलने पर अपडेट किया जाता है। सर्वर और प्रदाता अलग-अलग होते हैं, इसलिए बदलाव पहले सुरक्षित तरीके से जाँचें। देखें: संपादकीय नीति और अस्वीकरण.