DMARC Alignment Explained

The alignment requirement

DMARC passes only when at least one of the following is true:

• SPF alignment: The domain in the Return-Path (envelope sender) matches the domain in the From: header, and SPF passes for that domain.
• DKIM alignment: The signing domain (d= in the DKIM-Signature header) matches the domain in the From: header, and the DKIM signature is valid.

You need at least one. Both is better.

An alignment failure example

Here's a case where SPF and DKIM both pass but DMARC still fails:

From:       billing@yourcompany.com
Return-Path: bounce@sendgridmail.net      (SPF passes for sendgridmail.net)
DKIM d=:    sendgrid.net                  (DKIM passes for sendgrid.net)

SPF passes for sendgridmail.net, not yourcompany.com. DKIM passes for sendgrid.net, not yourcompany.com. Neither aligns with the From: domain. DMARC fails.

What alignment actually checks

DMARC compares the "Organizational Domain" — the registered domain stripped of subdomains. So mail.yourcompany.com, yourcompany.com, and news.yourcompany.com all share the same organizational domain: yourcompany.com.

By default, DMARC uses relaxed alignment: any subdomain of the organizational domain will align. Strict alignment requires an exact match.

Relaxed vs. strict alignment

Strict alignment is set with aspf=s (for SPF) and adkim=s (for DKIM) in your DMARC record. Most domains use relaxed alignment. Only move to strict when you have full control over every sender's configuration.

Fixing alignment failures

When a sender fails DMARC alignment, you have a few options:

For DKIM alignment: Ask the vendor to sign mail with a key under your domain. Most platforms support this via a CNAME record you publish in DNS. The vendor's infrastructure signs mail, but under your domain's selector.

For SPF alignment: Configure a custom bounce/return-path domain at the vendor. Instead of bounces going to bounce@sendgridmail.net, they go to bounce.yourcompany.com. This aligns SPF.

If neither is possible: Use a subdomain for that sender. Send marketing mail from news.yourcompany.com instead of your root domain. Then SPF and DKIM for that subdomain can be controlled separately.

Why alignment matters when enforcing

Once you move to p=quarantine or p=reject, alignment failures become real deliverability problems. Mail that fails DMARC alignment will be routed to spam or rejected, even if the sending platform itself is legitimate.

This is why the enforcement path starts with p=none: you need to discover every alignment failure before you start blocking mail on it.