You often see a message with spf=pass and dkim=pass in its headers and, right after, dmarc=fail. It looks like a contradiction, but it isn't. DMARC does not just ask whether SPF and DKIM worked: it asks whether they worked for the right domain. This concept is called alignment, and it is the part of DMARC that people configuring mail understand last.
The three domains in an email
A message contains at least three domains that may differ from one another.
- The From domain (RFC5322.From): the one the recipient sees in the mail client. It is the identity DMARC aims to protect.
- The Return-Path domain, also called envelope sender or MAIL FROM: the address bounces return to. SPF is evaluated on it.
- The DKIM signature domain, that is, the
d=value in theDKIM-Signatureheader.
SPF checks that the server delivering the message is authorized by the Return-Path domain. DKIM checks that the signature is valid for the d= domain. Neither of them, on its own, says anything about From. That is where DMARC comes in.
The DMARC rule
A message passes DMARC if at least one of these two checks is true:
- SPF passes and the Return-Path domain is aligned with From;
- DKIM passes and the
d=domain is aligned with From.
One is enough. That is why a broken SPF is not serious if DKIM is aligned, and vice versa.
A concrete example
A company uses an external platform for its newsletters. The message arrives with these characteristics:
From: News <news@example.com>
Return-Path: <bounce-8812@mailer.example.net>
DKIM-Signature: v=1; d=mailer.example.net; s=k1; ...
SPF passes, because the platform's server is authorized by mailer.example.net. DKIM passes, because the platform's signature is valid. But both domains differ from example.com: neither is aligned, so DMARC fails. With a p=reject policy the message is rejected.
The fix is to configure the platform to sign with d=example.com (publishing its key under a selector on your domain) or to use a Return-Path such as bounce.example.com.
Relaxed or strict
DMARC offers two alignment modes, configurable separately for SPF and DKIM with the aspf= and adkim= tags.
| Mode | Value | When the domains are aligned |
|---|---|---|
| Relaxed | r (default) |
they belong to the same organizational domain |
| Strict | s |
they match exactly |
The organizational domain is, put simply, the registered domain: for news.example.com it is example.com. The calculation relies on a public list of domain suffixes, so that for a name like example.co.uk the organizational domain is correctly example.co.uk and not co.uk.
With relaxed alignment, a DKIM signature with d=mail.example.com is aligned with a From of info@example.com. With strict alignment, it isn't.
Which to choose
For almost every domain, relaxed is the right choice. It lets you delegate a bounce or signing subdomain to each service without losing alignment, and protection stays solid: an attacker would still need to control a subdomain of your domain.
Strict makes sense in particular cases, for example when some subdomains are run by third parties you don't fully trust: if a supplier controls promo.example.com, under relaxed alignment it could sign messages with a From of example.com. Under strict it can't.
_dmarc.example.com. TXT "v=DMARC1; p=reject; adkim=s; aspf=r; rua=mailto:dmarc@example.com"
How to check alignment
The Authentication-Results header added by the receiver lists every domain involved:
Authentication-Results: mx.example.org;
dkim=pass header.d=example.com header.s=s1;
spf=pass smtp.mailfrom=bounce.example.com;
dmarc=pass header.from=example.com
Compare header.from with header.d and with the domain of smtp.mailfrom. If at least one of them matches or, in relaxed mode, shares the organizational domain, alignment is in order.
Recurring mistakes
- Treating the «SPF pass» shown by the provider's dashboard as sufficient: it is often a pass on the provider's domain.
- Switching to
adkim=swithout checking that every signature uses exactly the From domain. - Forgetting From subdomains: if you send from
info@shop.example.com, that is the domain that must be aligned.
In short
- An email has at least three domains: From, Return-Path and the DKIM signature's
d=. - DMARC passes if SPF or DKIM pass and their domain is aligned with From.
- Relaxed alignment accepts the same organizational domain, strict requires an exact match.
- Relaxed suits almost every case; strict is for when you don't trust whoever manages your subdomains.
- The
Authentication-Resultsheader shows all the domains to compare.
