DMARC alignment: relaxed vs strict, adkim and aspf
Alignment is DMARC's core concept: the authenticated domain must match the From: domain. How relaxed and strict modes work and which mechanism carries the pass.
Alignment is the single most important idea in DMARC. It answers a straightforward question: does the domain that passed authentication match the domain in the From: header? SPF and DKIM are ID checks: they verify a sender's eligibility to use a domain. Alignment is the step that confirms the person showing the ID is the same person named on the meeting invitation. Without that step, the ID check means nothing to the recipient.
One aligned pass is enough
DMARC passes if at least one of the following is true: SPF passes and the SPF-authenticated domain aligns with the From: domain, or DKIM passes and the DKIM-signing domain (the d= tag) aligns with the From: domain. Only one needs to work. If DKIM aligns but SPF does not, DMARC still passes, and this asymmetry is what makes DMARC deployable in the real world, where ESP bounce domains routinely break SPF alignment while custom DKIM signing preserves DKIM alignment.
The SPF side of this rule, envelope sender versus From: header, custom bounce domains, and why forwarding kills aligned SPF, has its own detailed entry: SPF alignment. The short version: an SPF pass for your ESP's domain contributes nothing to your DMARC, and the fix is a custom Return-Path on your own subdomain.
Relaxed vs strict alignment
Alignment has two modes, and the difference matters when working with subdomains. Relaxed alignment (the default) requires the authenticated domain and the From: domain to share the same organizational (root) domain: mail.example.com aligns with example.com. This is the sensible default for most configurations. Strict alignment requires an exact match: mail.example.com does not align with example.com.
Alignment modes compared
| Feature | Relaxed (r, default) | Strict (s) |
|---|---|---|
| mail.example.com vs example.com | aligned | not aligned |
| example.com vs example.com | aligned | aligned |
| example.org vs example.com | not aligned | not aligned |
| Typical use | Standard setups with sending subdomains | Subdomains as separate trust boundaries |
Strict mode is useful when subdomains act as separate trust boundaries, for example when different teams or services own different subdomains and should not be able to authenticate on each other's behalf. For everyone else, relaxed mode matches how production email actually works: bounce subdomains, ESP signing subdomains, and regional sending domains all align with the organizational domain without extra configuration.
The adkim and aspf tags
The adkim (DKIM alignment) and aspf (SPF alignment) tags in the DMARC record control the mode per mechanism. Both default to r (relaxed), both accept s (strict), and they are set independently: a record can demand strict DKIM alignment while leaving SPF relaxed. Most records never set either tag and simply inherit the relaxed defaults, which is the right call unless a specific trust-boundary requirement says otherwise.
Diagnosing alignment in practice
Alignment failures on known senders are the most common issue during a DMARC rollout, and they show up plainly in aggregate reports: an ESP's source IP passes SPF for the ESP's domain and passes DKIM for the ESP's domain, and neither aligns with yours. The fix is almost always configuring custom DKIM signing through the ESP's dashboard, so the DKIM d= domain matches the From: domain. In a delivered message's Authentication-Results header, dmarc=pass confirms alignment succeeded; dkim=pass with someone else's domain in header.i alongside dmarc=fail is the signature of the unaligned-vendor problem.
Frequently asked questions
Do both SPF and DKIM need to align for DMARC to pass?
Should I use strict alignment for better security?
How is the organizational domain determined for relaxed matching?
Can alignment pass while SPF and DKIM both technically pass for other domains?
Key takeaways
- Alignment connects an SPF or DKIM pass to the From: domain the recipient actually sees
- One aligned mechanism is enough for DMARC to pass; DKIM is usually the resilient one
- Relaxed mode (default) matches on the organizational domain; strict demands an exact match
- adkim and aspf control the modes independently and rarely need changing from their relaxed defaults
- Unaligned vendor mail is fixed with custom DKIM signing and custom bounce domains, verified in aggregate reports