What alignment means

DMARC alignment connects authentication results to the domain users see in the From header. A message can have a valid SPF result or a valid DKIM signature and still fail DMARC if the authenticated domain is not aligned with the visible From domain under the published policy. This distinction explains many confusing reports. “SPF passed” does not automatically mean “DMARC passed,” because DMARC also evaluates domain relationship.

SPF alignment

For SPF alignment, the domain authenticated through SPF is compared with the domain in the message's From header. Relaxed alignment permits related organizational domains in situations covered by the DMARC specification, while strict alignment requires a closer match. When troubleshooting, write down both values instead of looking only at the word PASS. A message may show an SPF pass for a service-owned return-path domain while the visible From domain is your brand domain.

DKIM alignment

DKIM alignment compares the domain in the valid DKIM signature with the visible From domain. A third-party sending service can often sign with your domain if you configure the required DNS record and signing identity. DKIM alignment is frequently valuable for systems where the final connecting IP may change or where forwarding affects SPF. The key is to ensure that the signer uses an appropriate domain and that the selector's public key is correctly published.

Strict versus relaxed

DMARC alignment mode is a policy setting, not a replacement for correct authentication. Relaxed alignment is commonly easier to operate across related subdomains, while strict alignment can provide tighter identity control. The right choice depends on the organization's domain architecture and sending systems. Do not change alignment mode simply because a report shows failures. First determine which legitimate sender is failing and whether the authenticated domain should be changed instead.

A practical troubleshooting workflow

Start with the message headers. Record the From domain, SPF-authenticated domain and DKIM signing domain. Then determine which authentication result is aligned. If neither is aligned, identify the sending platform responsible and configure it to authenticate with an appropriate domain. After a change, test a real message and inspect the headers again. DMARC aggregate reports can then help confirm whether the change improved alignment across the broader sending population.

Alignment checklist

Maintain a sender inventory containing the visible From domain, return-path domain, DKIM signing domain, SPF mechanism and sending provider. Review it whenever a new marketing, transactional or support platform is introduced. This inventory turns DMARC from a reactive troubleshooting project into a repeatable change-management process.

Practical checklist

• Record the exact hostname, domain, IP address or SMTP response involved in the issue.
• Change one variable at a time and keep a short change log.
• Verify the result with a real test message and inspect the relevant DNS or SMTP evidence.
• Document the final configuration so the next migration or incident starts with known-good information.

Frequently asked questions

Is there one setting that guarantees successful delivery?

No. Email delivery depends on the complete sending path, including infrastructure, authentication, recipient policy, message handling and operational practices.

Should I change several settings at once when troubleshooting?

Usually no. Controlled changes make it easier to identify the cause and confirm whether the fix actually worked.