DMARC Alignment Lab

Two independent paths can satisfy the policy

DMARC passes if either an aligned SPF path or an aligned DKIM path succeeds. SPF alignment compares the visible From domain with the envelope domain in Return-Path; DKIM alignment compares it with the signing domain in the d= tag. Only one needs to align, which is why the two paths should be evaluated separately rather than averaged.

In practice DKIM alignment is the more durable path. SPF alignment breaks when a message is forwarded, because the forwarding system replaces the envelope sender. A DKIM signature survives forwarding as long as the signed content is not modified, so a domain relying only on aligned SPF will see DMARC failures on legitimate forwarded mail.

• Aligned SPF or aligned DKIM is sufficient; both are not required.
• SPF alignment does not survive most forwarding.
• A configuration with only one working path has no redundancy.

Read the alignment guide

Relaxed and strict change the comparison boundary

Strict alignment requires an exact domain match. Relaxed alignment, which is the default, compares organizational domains, so a subdomain can align with its parent. Choosing strict is a meaningful restriction that breaks any sender operating from a subdomain unless every path is deliberately configured for it.

The organizational boundary itself is no longer defined by a static public suffix list. RFC 9989 determines it through a bounded DNS tree walk, which means the boundary can be discovered rather than assumed. Modelling alignment against the actual tree walk is more accurate than applying a fixed suffix rule.

Trace the organizational domain boundary

Model a change before enforcing it

Moving from monitoring to quarantine or rejection is the point where configuration mistakes become visible as lost mail. The lab evaluates a hypothetical policy against real authentication evidence, so the consequence of enforcement can be examined before the policy is published.

The prerequisite for enforcement is a complete sender inventory. Every legitimate service that sends for the domain needs at least one aligned path, and the way to confirm that is aggregate reporting over a period long enough to include infrequent senders such as quarterly invoicing or annual notices.

Review aggregate reports before enforcing · Build the sender inventory

Example: a platform-signed message that fails alignment

Known limits

• Modelled results describe the supplied evidence; receivers apply their own local policy in addition to DMARC.
• Alignment can be satisfied for one message and fail for another sent through a different path.
• DNS observed at analysis time may differ from the state when a historical message was evaluated.

Common questions