Authentication and alignment answer different questions
SPF can authenticate the envelope sender and DKIM can authenticate a signing domain without either identity matching the domain the user sees in the From field. DMARC adds that relationship test. This is why a dashboard that shows “SPF pass” can coexist with a DMARC failure: the authenticated identity may belong to a delivery platform rather than the visible sender domain.
Two independent paths can satisfy DMARC
DMARC can pass through an aligned SPF path or an aligned DKIM path. A strong configuration usually makes at least one of those paths deliberate and stable for every legitimate sender. Custom bounce domains improve the SPF path; custom DKIM signing domains improve the DKIM path. The exact combination depends on what each email service provider supports.
Relaxed and strict alignment change the boundary
Strict alignment is an exact-domain comparison. Relaxed alignment compares Organizational Domains, but the current DMARC standard no longer defines that boundary through a static Public Suffix List. RFC 9989 uses a bounded DNS Tree Walk that can discover policy records at multiple levels and interpret explicit psd=n or psd=y boundaries. That means a modern alignment test for real domains should inspect the DMARC policy tree instead of assuming that the registrable domain is always the organizational boundary.
Test the message that actually leaves the platform
Configuration screens describe intent; headers describe reality. After domain authentication is configured, send a real message to a test recipient and inspect Authentication-Results, Return-Path and DKIM-Signature. That closes the gap between “the vendor says it is configured” and “the receiver observed an aligned authentication path.”
Verify the evidence
Use the live analysis that matches this workflow instead of relying on a generic status check.