DMARC Alignment: Relaxed vs Strict Modes
DMARC alignment connects the domain in the visible From address with the domain authenticated by SPF or DKIM. A message passes DMARC when at least one mechanism both passes authentication and aligns with the From domain.
Relaxed alignment accepts domains within the same organisational domain. Strict alignment requires an exact domain match. The relaxed mode is the default for both SPF and DKIM under RFC 9989.
DMARC alignment at a glance
| Check | Authenticated domain | Alignment tag | Relaxed rule | Strict rule |
|---|---|---|---|---|
| SPF | MAIL FROM domain | aspf | Same organisational domain | Exact domain |
| DKIM | Validated signature's d= domain | adkim | Same organisational domain | Exact domain |
DMARC looks at the RFC5322.From domain that people usually see when they get an email. This domain is called the Author Domain, and it's the one that people normally see in their mail client.
SPF contributes the domain from the SMTP MAIL FROM identity. DKIM contributes the d= value from any validated signature. A raw SPF or DKIM pass from an unrelated domain cannot produce a DMARC pass.
How does a message pass DMARC alignment?
A receiver checks SPF and DKIM separately. DMARC passes if either of these paths succeeds:
- SPF passes and its MAIL FROM domain aligns.
- DKIM validates and its
d=domain aligns.
Both paths do not need to pass. One authenticated and aligned path is enough.
A DMARC pass confirms authorised use of the From domain, but it does not certify that the message is safe or belongs in the inbox.
Relaxed vs strict DMARC alignment
Relaxed alignment compares organisational domains. If the visible From domain is billing.example.com, an authenticated domain of bounce.example.com can align because both belong to example.com.
Strict alignment compares the complete domains. With a visible From domain of billing.example.com, the authenticated domain must also be billing.example.com. The parent example.com and sibling bounce.example.com do not pass strict alignment.
| From domain | Authenticated domain | Relaxed | Strict |
|---|---|---|---|
billing.example.com | bounce.example.com | Pass | Fail |
billing.example.com | billing.example.com | Pass | Pass |
billing.example.com | mailer.example.net | Fail | Fail |
The aspf tag controls SPF alignment and the adkim tag controls DKIM alignment.
Each tag can use r for relaxed or s for strict. If you don't include a tag, it will default to relaxed alignment.
Which alignment mode should you choose?
Relaxed alignment fits most domains because authorised systems often use separate subdomains for the visible sender, bounce handling, and DKIM signing. RFC 9989 says nearly all domain owners have found relaxed alignment sufficient.
Strict alignment can suit a domain that controls every authenticated identifier and needs exact boundaries. Before enabling it, inventory each authorised sender and confirm the MAIL FROM and DKIM signing domains match every From domain exactly.
Strict mode can expose configuration errors that relaxed mode accepts. It can also reduce the risk created when control of one subdomain is delegated to another party, because a sibling subdomain cannot align with the From domain.
How do you publish the alignment tags?
Publish a single DMARC TXT record at _dmarc.example.com. This monitoring example requests aggregate reports and uses the relaxed defaults explicitly:
v=DMARC1; p=none; rua=mailto:dmarc-reports@example.com; aspf=r; adkim=r
The v=DMARC1 tag must come first. The p tag expresses the requested handling for messages that fail DMARC. Its values are none, quarantine, and reject. The optional rua tag requests aggregate reports at the listed address.
Use p=none while identifying authorised sources and correcting alignment failures. Review aggregate data, verify low-volume senders, then choose a stronger policy when legitimate mail is consistently authenticated and aligned.
Do not use pct= as a current staged-enforcement control.
RFC 9989 marks that tag historic. The current standard defines t=y as a policy test signal, but receivers still make the final handling decision.
How do you diagnose DMARC alignment failures?
Start with one message's Authentication-Results header and raw source, then trace the domains rather than relying on a dashboard summary.
- Record the RFC5322.From domain shown to the recipient.
- Check SPF for the MAIL FROM domain.
- Check each validated DKIM signature and its
d=domain.
- Compare those domains under the published
aspfandadkimmodes.
- Confirm that the DMARC record exists at the expected
_dmarcname and begins withv=DMARC1.
- Use aggregate reports to find other authorised sources with the same failure pattern.
A vendor can produce spf=pass or dkim=pass for its own unrelated domain while DMARC still fails. Fix the authenticated identity by configuring a custom MAIL FROM or DKIM signing domain that aligns with your From domain.
What happens when mail is forwarded?
Forwarding often changes the sending IP, so SPF may fail unless the forwarder rewrites the MAIL FROM identity.
A valid DKIM signature can survive when the forwarded message does not alter signed content.
Domains considering p=reject should not rely on SPF alone. RFC 9989 recommends valid DKIM signatures because indirect mail flows can break SPF.
Mailing lists and other intermediaries can still create delivery problems, so examine aggregate reports before enforcing a stronger policy.
What should you monitor after setup?
Review aggregate reports for new source IPs, changes in aligned pass rates, and authorised systems that authenticate with the wrong domain. Investigate a new source before classifying it as abuse because it may be a legitimate service that was never configured for alignment.
Keep report data protected. Aggregate reports can reveal sending patterns, while message-specific failure reports can contain more sensitive information. Apply access and retention controls that match your organisation's requirements.
Sources
Frequently Asked Questions
How do I set up DMARC correctly?
Confirm that every authorised sender passes SPF or DKIM with a domain aligned to the visible From domain. Publish one TXT record at _dmarc.example.com, begin with p=none and an aggregate-report address, review the reports, correct legitimate failures, then move to a stronger policy when the evidence supports it.
What are the different DMARC alignment modes?
Relaxed alignment accepts the same organisational domain, while strict alignment requires identical domains. The aspf and adkim tags select SPF and DKIM alignment, and both default to relaxed.
How do I fix DKIM signature alignment failures?
Inspect a validated DKIM signature and compare its d= domain with the visible From domain. Configure the sender to sign with an aligned domain. Under relaxed mode, both domains may share the same organisational domain. Under strict mode, they must be identical. A valid signature from an unrelated domain does not satisfy DMARC alignment.
What does DMARC stand for?
DMARC stands for Domain-based Message Authentication, Reporting, and Conformance. RFC 9989 defines the current standards-track protocol. It uses SPF and DKIM results plus domain alignment to validate authorised use of the domain in the visible From address.
