DMARC Alignment: What is it and why is it important?

Quoted on this wiki

Every place a page here uses this source, in the order the words come in it.

1. Why does my email fail DMARC even though my SPF record says ‘pass’?This is a common situation. Third-party senders like Mailchimp or SendGrid often use their own domain as the Return-Path domain. This causes the unalignment of your ‘From-domain’. Contact your email provider to set up a custom Return-Path domain. “To align DKIM, add the TXT or CNAME records they provide to your DNS.” Does DMARC alignment affect my subdomains?Yes. By default, all subdomains inherit the parent domain’s policy. Use the ‘sp’ tag if you want to apply a different policy for subdomains. For example, the parent domain has p=reject, but you want to monitor without enforcement on your subdomains, add: ‘sp=none’ to the DMARC record of the parent domain.

   In Third-party sender authentication

2. What is the difference between ‘Strict’ and ‘Relaxed’ alignment?This is based on the aspf (SPF) and adkim (DKIM) tags in your dmarc record. Relaxed (r), which is the default, allows subdomains to pass alignment. Strict  (s) requires an exact match of the From-domain. The strict DKIM alignment in your DMARC record looks like this: ‘adkim=s’. “Third-party senders like Mailchimp or SendGrid often use their own domain as the Return-Path domain.” How do I handle alignment from third-party senders?Most SaaS platforms, such as Zendesk, HubSpot, and Salesforce, send email on your behalf. To align DKIM, add the TXT or CNAME records they provide to your DNS. This makes sure these senders use your domain. For SPF, add their ‘include’ to your SPF record and configure a custom Return-Path domain.

   In Third-party sender authentication

3. Why does my email fail DMARC even though my SPF record says ‘pass’?This is a common situation. Third-party senders like Mailchimp or SendGrid often use their own domain as the Return-Path domain. This causes the unalignment of your ‘From-domain’. Contact your email provider to set up a custom Return-Path domain. “For SPF, add their ‘include’ to your SPF record and configure a custom Return-Path domain.” Does DMARC alignment affect my subdomains?Yes. By default, all subdomains inherit the parent domain’s policy. Use the ‘sp’ tag if you want to apply a different policy for subdomains. For example, the parent domain has p=reject, but you want to monitor without enforcement on your subdomains, add: ‘sp=none’ to the DMARC record of the parent domain.

   In Third-party sender authentication

Quotes are verbatim and belong to their publishers. Where a quote has been translated, the original wording is kept below it.