Skip to content
Clinic open · free diagnosis, no appointment needed2,000+ domains monitored

DMARC alignment

The DMARC requirement that the domain authenticated by SPF or DKIM matches the domain in the visible From header, either exactly (strict) or allowing subdomains (relaxed). Defined in RFC 9989 section 4.4.

Sumit Raj · reviewed

The condition most half-configured domains fail without noticing.

DMARC does not ask “did SPF pass”. It asks “did SPF pass for the domain in the From header”. A message can pass SPF for mailer.vendor.com, carry a valid DKIM signature from vendor.com, and still fail DMARC for yourcompany.com, because neither identifier lines up with what the recipient sees. The message authenticated perfectly. It authenticated somebody else.

Relaxed alignment, the default, accepts a subdomain: mail.yourcompany.com aligns with yourcompany.com. Strict requires an exact match and breaks most vendor setups without warning.

This is why adding a vendor to your SPF record does not make their mail pass DMARC. The vendor must either use your domain in the envelope sender, or sign with a key published in your DNS.

Related

  • DMARCDomain-based Message Authentication, Reporting and Conformance: a DNS record that requires SPF or DKIM to pass for the visible From domain, and instructs receivers what to do when neither does. Defined in RFC 9989.
  • SPFSender Policy Framework: a DNS TXT record listing the servers authorised to send mail using a domain in the SMTP envelope sender. Defined in RFC 7208.
  • DKIMDomainKeys Identified Mail: a cryptographic signature added to outgoing messages and verified against a public key published in the sending domain's DNS. Defined in RFC 6376.
  • What is DMARC?The only email record that looks at the address your recipient actually sees, and the only one that stops somebody sending in your name.
  • DMARC, from a first record to enforcementThe only record that governs the address your recipient actually sees. What it does, what it does not, and how to reach enforcement without breaking your own mail.
  • DMARC TestTree-walk discovery, inheritance, test mode and the policy receivers really apply.

Every fix on this site is yours to implement. If you would rather someone did it, I take this work directly.