What is DMARC alignment?

Definition

Alignment is DMARC's domain-matching requirement. A message passes DMARC only if at least one authentication result is both a pass and aligned with the domain in the visible Header From:

• SPF alignment: the Return-Path domain that passed SPF matches the From domain.
• DKIM alignment: the d= domain of a valid DKIM signature matches the From domain.

One aligned pass is enough; DMARC does not require both.

Relaxed vs strict

Each check has a mode, set by the aspf and adkim tags in your DMARC record. In relaxed mode (the default), domains match when they share the same organizational domain, so news.example.com aligns with example.com. In strict mode the match must be exact. Relaxed is the right default for almost everyone; strict is a hardening step for domains that never delegate sending to subdomains.

Why an unaligned pass is worthless

Consider a spoofed message: the attacker sends from their own server, with their own domain in the Return-Path and their own DKIM signature. SPF passes (for their domain). DKIM passes (for their domain). The From line says you. Without alignment, that message authenticates cleanly; with DMARC, both passes are unaligned, so the message fails and your policy applies. This is the entire reason DMARC exists as a layer above SPF and DKIM.

The everyday failure case

The most common alignment problem is not an attack: it is a legitimate vendor sending with its own bounce domain in the Return-Path and no DKIM signature for your domain. SPF passes unaligned, nothing else passes, and your own mail fails DMARC. The fix is configuration, not mystery: enable the vendor's custom DKIM signing (and custom Return-Path if offered) so the pass carries your domain. Aggregate reports are how you find these senders before an enforcement policy starts punishing them.