Domain Alignment (DMARC)

Domain alignment is the check in DMARC that the domain authenticated by SPF (the envelope sender) or by DKIM (the d= domain) matches the domain in the From header. Passing SPF or DKIM alone is not enough.

Why it matters

Without alignment, an attacker could pass SPF with their own domain while showing yours in From. DMARC passes when either SPF or DKIM passes and aligns. In relaxed mode (the default) the organisational domain must match, so mail.example.com aligns with example.com; in strict mode, the domains must be identical. You set the mode in the DMARC record with aspf and adkim. Alignment is the usual reason a third-party service passes SPF yet still fails DMARC.

Example

From: hello@example.com
SPF:  pass, smtp.mailfrom=bounce.vendor.net   -> not aligned
DKIM: pass, d=example.com                    -> aligned
DMARC: pass (DKIM aligned)

The vendor's SPF is irrelevant to alignment, but its DKIM signature uses the customer's own domain, so DMARC passes.

Common mistakes

Assuming SPF pass means DMARC pass.
Setting strict alignment without testing subdomains that send mail.
Not configuring custom DKIM signing at the email service, so it signs with its own domain.

Get notified when this term updates

Plus occasional practical tips on uptime and monitoring, nothing else. Unsubscribe anytime.

यह पेज सामान्य जानकारी है, जिसे हमारी संपादकीय टीम ने लिखा है और दस्तावेज़ीकरण बदलने पर अपडेट किया जाता है। सर्वर और प्रदाता अलग-अलग होते हैं, इसलिए बदलाव पहले सुरक्षित तरीके से जाँचें। देखें: संपादकीय नीति और अस्वीकरण.