# DMARC alignment: Definition and How It Works

Source: https://wraps.dev/glossary/dmarc-alignment

DMARC alignment is the check that ties a passing SPF or DKIM result back to the domain in the visible From header, using either a strict exact-match mode or a relaxed organizational-domain match.

## Why passing SPF or DKIM alone isn't enough

SPF authenticates the envelope return-path and DKIM authenticates whichever domain signed the message — neither one is required to have any relationship to the domain a recipient actually sees in the From: header. A message can pass SPF against a completely unrelated return-path domain and still be a plausible-looking spoof of the domain in From:. Alignment is the rule that closes that gap: for DMARC to pass, at least one of SPF or DKIM has to both pass and align with the visible From domain.

## Relaxed is the default, and it means organizational domain

The \`aspf=\` and \`adkim=\` tags in a DMARC record set alignment mode, each independently, to \`r\` (relaxed, the default when omitted) or \`s\` (strict). Relaxed mode considers \`mail.example.com\` and \`example.com\` aligned, because they share an organizational domain — the registrable domain one level below the public suffix. That is the mode almost every real-world setup with subdomains for different sending systems needs.

## Strict mode requires an exact match

Strict alignment requires the SPF return-path domain (or the DKIM \`d=\` signing domain) to match the From domain exactly, subdomain and all. A message signed by \`mail.example.com\` does not align in strict mode against a From address of \`example.com\`, even though both are clearly the same organization. Strict mode is rarely what you want unless every sending system genuinely signs and sends as the exact From domain.

## Only one mechanism has to align, not both

DMARC's pass condition is SPF-aligned OR DKIM-aligned, not both. This is what makes DKIM the more resilient of the two for DMARC purposes: SPF alignment breaks the moment a message is forwarded through an intermediate server not in the original SPF record, but a DKIM signature travels with the message and can still align correctly after a forward, which is why DKIM is usually the mechanism actually carrying DMARC pass results for mail that transits third-party infrastructure.

## Why it matters

Alignment is the actual anti-spoofing mechanism in DMARC — without it, DMARC would only be checking that SPF or DKIM passed for some domain, which an attacker can arrange for a domain they control while still forging your visible From address. Getting alignment mode wrong (usually by assuming strict when relaxed was needed for a subdomain setup) is a common reason a domain's DMARC pass rate looks lower than its actual SPF/DKIM health would suggest.

## Common questions

### What's the difference between relaxed and strict DMARC alignment?

Relaxed (the default) considers a subdomain aligned with its parent organizational domain, so mail.example.com aligns with example.com. Strict requires an exact domain match, subdomain included, which most multi-system sending setups don't meet.

### Do both SPF and DKIM need to align for DMARC to pass?

No, only one of them. DMARC passes if SPF is aligned and passing, or DKIM is aligned and passing, or both. That either/or is deliberate, since SPF alignment routinely breaks on forwarded mail in a way DKIM alignment does not.

### Why does my mail pass SPF but still fail DMARC?

SPF can pass against a return-path domain that has no alignment with your visible From address — a common setup when a third-party sending platform uses its own return-path. DMARC failing there means the pass didn't align, not that SPF itself is broken.