What Is DMARC alignment?

Relate authentication to the author domain

An email can have several domain identities. The visible author address, SPF identity and DKIM signing domain do not automatically match. DMARC checks whether an authenticated SPF or DKIM identifier aligns with the author domain. A message can satisfy DMARC through one aligned passing method even when the other method fails. Three independent green checks are not the protocol's definition of a pass.

For DKIM, the relevant identity is the signing domain in a valid signature, not the selector or a friendly display name. For SPF, evaluate the applicable SMTP domain identity rather than assuming the visible From address was what SPF authenticated. A provider can sign mail correctly with its own unrelated domain while leaving the customer's author domain unaligned.

Strict and relaxed matching

Strict alignment requires an exact domain match. Relaxed alignment uses the organizational-domain relationship defined by DMARC. Do not reduce that relationship to comparing the last two labels of every domain name. RFC 9989, published in May 2026, supersedes RFC 7489 and defines the current protocol, including DNS-based domain discovery. A receiving implementation may still expose legacy terminology, so retain the actual identifiers and results when investigating differences.

Diagnose a particular message

Read the author domain, the evaluated SPF identity, each relevant DKIM signature and the receiver's authentication result. Separate authentication failure from a passing but unaligned identity. Forwarding or message modification can affect the available authentication paths in different ways, so a generic pass from a sender dashboard is insufficient. Correct the responsible sending service and verify a representative message before changing enforcement policy. Alignment is a domain-identity control; it does not establish that content is wanted, make a message safe or guarantee a particular mailbox folder.