Tools · Email security · 03 / 18
DMARC alignment: why SPF or DKIM passing is not enough
Learn how DMARC ties SPF and DKIM results to the visible From domain, the difference between relaxed and strict alignment, and how third-party senders commonly fail it.
The gap DMARC closes
An attacker can send mail with their own domain in the envelope sender and DKIM d= tag, pass both checks, and still put your domain in the From header the recipient sees. DMARC requires that at least one passing mechanism uses a domain aligned with the From header domain, which closes that gap.
Relaxed and strict
With relaxed alignment, the default, the organizational domains must match, so mail.example.org aligns with example.org. With strict alignment, set with aspf=s or adkim=s, the domains must be identical. Relaxed is right for most organizations; strict suits domains where every sender is tightly controlled.
From: billing@example.org Return-Path: bounce@mail.example.org SPF pass, relaxed aligned, strict not aligned DKIM d=sendvendor.example DKIM pass, not aligned DMARC: pass under relaxed (SPF aligned); fail under aspf=s unless DKIM aligns
Lab: assess alignment for three senders
Collect one message each from your main mail platform, a marketing tool, and a ticketing or billing system that send as your domain. For each, write down the From domain, the Return-Path domain and SPF result, and the DKIM d= domain and result from the Authentication-Results header. Mark whether each aligns. Any sender aligning on neither needs custom DKIM signing with your domain or a custom return-path subdomain.
sender | From | Return-Path (SPF) | DKIM d= | SPF aligned | DKIM aligned mail platform | example.org | example.org (pass) | example.org (pass) | yes | yes marketing | example.org | bounces.vendor.example (pass) | vendor.example (pass) | no | no -> configure custom DKIM ticketing | example.org | help.example.org (pass) | example.org (pass) | yes | yes
Fixing third-party senders
Most services support signing with your domain by publishing a CNAME or TXT selector they provide, and many support a custom bounce domain under your domain. DKIM alignment is usually preferred because it survives forwarding better than SPF.
Diagram
Relaxed versus strict alignment
Strict needs an exact match; relaxed needs the same organizational domain.
mail.example.org vs example.org. Aligned
example.org vs example.org. Aligned
vendor.example vs example.org. Not aligned
mail.example.org vs example.org. Not aligned
example.org vs example.org. Aligned
vendor.example vs example.org. Not aligned
Check yourself
1. Which domain must SPF or DKIM align with for DMARC?
2. Under relaxed alignment, does mail.example.org align with example.org?
3. What is the usual fix for a vendor that aligns on neither mechanism?