Authentication alignment

Treat DMARC alignment as a comparison across the sender's fields. Start with the visible From address and trace the domain authenticated by each path. DMARC passes or fails based on how closely the visible From domain matches the sending domain from SPF or DKIM, a relationship called alignment.¹ A message can pass SPF and still fail DMARC when the domains do not align with the visible From domain.² DMARC passes when at least one SPF or DKIM check passes with alignment.³

Run the alignment check

Check the fields in the order a receiving system evaluates them. Keep SPF and DKIM as separate paths until you apply the DMARC result.

• Record the visible From domain, the SPF-authenticated Return-Path domain, and the DKIM d= domain. DMARC compares the visible From domain with the domain authenticated by SPF or the domain in the DKIM d= tag.⁴
• Check whether SPF authentication passed and whether DKIM authentication passed. Treat each result as a separate checkpoint before judging alignment.
• For the SPF path, compare the domain in MAIL FROM with the domain in From. DMARC uses SPF to verify whether those domains are aligned.⁵
• For the DKIM path, compare the signing domain in the d= value with the domain in From. DMARC uses the DKIM result to verify that this signing domain aligns with From.⁶
• Apply the DMARC rule after both comparisons. One path with authentication and alignment can carry the message through DMARC, while two failed alignment paths leave a domain mismatch to fix.

Write down the result for each path as you inspect it. This separates an authentication failure from an alignment failure and gives you a specific field to hand to whoever manages the sending system.

Choose the alignment mode

The same pair of domains can produce a different result under a different alignment mode. Read that setting before treating a parent and child domain mismatch as a failure.

DMARC supports strict and relaxed alignment modes for SPF and DKIM. The aspf and adkim tags in the DMARC record set those modes.⁷ Under relaxed SPF alignment, a parent domain can align with a subdomain in the corresponding From or Envelope From field.⁸ If the policy contains aspf=s, the SPF check must use strict alignment.⁹ The adkim tag controls whether the DKIM alignment check is relaxed or strict.¹⁰

When the result looks surprising, inspect the mode before editing the sender's DNS records. A mismatch under strict settings needs a different fix from a parent and child relationship that the policy allows.

Fix the mismatch

Once you know which comparison failed, trace that field back to the system that produced it. The correction depends on the path and on how the message reached the recipient.

If SPF and DKIM pass individually while DMARC fails, treat the problem as alignment rather than authentication.¹¹ Check whether a forwarding step changed the path. Messages forwarded automatically between domains or organizations can fail DMARC alignment even when the original sender is legitimate.¹²

Review third party sending arrangements too. A marketing sender may place its own domain in the MFrom field to manage bounce messages, leaving that domain different from the brand's Header From domain and causing SPF alignment to fail.¹³

For an SPF alignment failure, take the exact MAIL FROM and From values to the technology provider that manages the sending system. The provider may need to give system-specific instructions for correcting the mismatch.¹⁴ For DKIM, inspect the d= value and adjust the signing configuration so the DKIM path aligns with the visible From domain.

After a correction, run the same comparison again on a message from that sender. Move on when you can identify which path authenticates, which path aligns, and which policy mode produced the result.

What not to do

• Do not require the DKIM signing domain to match the MAIL FROM or From domain as a general DKIM rule. The DKIM signing domain does not have to match either address.¹⁵
• Do not treat a published DMARC record as proof that the message itself passes alignment. A message can still fail the alignment check.¹⁶
• Do not tighten the DMARC policy while failed results still show an alignment problem that has not been fixed.¹⁷