DMARC alignment

SPF authenticates the envelope sender — the `MAIL FROM` address — which the recipient never sees. SPF alignment requires that domain to match the `From` header domain.

DKIM authenticates the signing domain in the signature's `d=` tag. DKIM alignment requires that domain to match the `From` header domain.

DMARC passes if either mechanism passes and is aligned. Both failing, or both passing while misaligned, is a DMARC failure.

This is why a message can show `spf=pass` in its authentication results and still fail DMARC: the SPF check passed for a domain that is not the one in the `From` header.

Relaxed alignment, the default, requires the organisational domain to match: `mail.example.com` aligns with `example.com`.

Strict alignment requires an exact match of the full domain.

The mode is set separately for each mechanism, with the `aspf` and `adkim` tags in the DMARC record.

Relaxed is the right default for almost everyone. Strict breaks the common pattern of sending from a subdomain and is worth adopting only with a specific reason.

A third-party sending platform using its own bounce domain in the envelope without a custom return path configured for your domain. SPF passes for the platform, and alignment fails.

The same platform signing with its own domain rather than yours, so DKIM passes unaligned as well — the case where both mechanisms pass and DMARC still fails.

The fix in both cases is the same: configure the platform with a subdomain of yours for the return path and for DKIM signing. Every serious provider supports this and documents it.

Forwarding breaks SPF alignment by design, which is precisely why DKIM alignment carries the message through forwarding.

Open the full headers of a received message and find `Authentication-Results`. It reports the SPF and DKIM outcomes with the domain each applied to.

Compare those domains against the `From` header. Equality, or a shared organisational domain, is alignment.

The `dmarc=` result in the same header is the combined verdict, and it is the one that decides what the recipient's policy does.

DMARC aggregate reports, requested with the `rua` tag, give the same picture across every source sending as your domain, which is how the ones you forgot about are found.