What Is DMARC Alignment? Relaxed vs Strict, SPF vs DKIM

DMARC alignment is the rule that an SPF or DKIM pass only counts for DMARC if the domain that passed matches the domain in the visible From header. SPF alignment compares the envelope sender domain to the From domain; DKIM alignment compares the d= signing domain to the From domain. A message passes DMARC if at least one of them passes and aligns.

Quick summary

• SPF alignment: the domain in MAIL FROM (also called envelope From or Return-Path) must match the From header domain. If OquMail sends with a Return-Path on your domain, SPF aligns.
• DKIM alignment: the d= value in the DKIM-Signature must match the From header domain. Because OquMail signs with d=yourdomain.com, DKIM aligns.
• Only one of the two needs to align for DMARC to pass. DKIM alignment survives forwarding; SPF alignment usually does not.
• Send a test to a Gmail address, open it, choose Show original.
• In the summary, read SPF, DKIM and DMARC. Each shows PASS or FAIL plus the domain that passed.

Why alignment exists

SPF and DKIM on their own authenticate domains the recipient never sees. A spammer can pass SPF for spammer-domain.net and still put you@yourdomain.com in the From line that appears in the inbox. DMARC fixes that by insisting the authenticated domain and the displayed domain agree. Alignment is the link between the technical check and what the human reads.

The two identifiers

• SPF alignment: the domain in MAIL FROM (also called envelope From or Return-Path) must match the From header domain. If OquMail sends with a Return-Path on your domain, SPF aligns.
• DKIM alignment: the d= value in the DKIM-Signature must match the From header domain. Because OquMail signs with d=yourdomain.com, DKIM aligns.
• Only one of the two needs to align for DMARC to pass. DKIM alignment survives forwarding; SPF alignment usually does not.

Relaxed vs strict mode

The DMARC record can tune how exact the match must be with two tags. adkim controls DKIM alignment and aspf controls SPF alignment. Both default to r (relaxed).

v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.com; adkim=r; aspf=r

Relaxed (r): news.yourdomain.com aligns with yourdomain.com (same organisational domain)
Strict (s):  news.yourdomain.com does NOT align with yourdomain.com (exact match required)

How to check alignment on a real message

1. Send a test to a Gmail address, open it, choose Show original.
2. In the summary, read SPF, DKIM and DMARC. Each shows PASS or FAIL plus the domain that passed.
3. Scroll to authentication (proof that email really comes from your company)-Results. Look for DMARC (a policy that tells providers what to do if someone fakes your domain)=pass header.from=yourdomain.com. That header.from is the domain alignment is measured against.
4. If SPF passed for a different domain than header.from but DKIM passed for yourdomain.com, DMARC still passes through DKIM.
5. Publish a DMARC record with rua= and read the aggregate reports after a few days to see alignment across all your senders.

Common alignment failures

• A newsletter tool sends with its own bounce domain and signs with its own d=, so neither identifier aligns. Fix: enable custom domain authentication in that tool.
• A contact form plugin sends From your address through the website host, which neither signs for your domain nor is in your SPF. Fix: send through the OquMail API instead.
• Strict mode with a sending subdomain. aspf=s makes mail from notify.yourdomain.com fail against a From of yourdomain.com. Keep relaxed unless you have a reason.
• Forwarded mail loses SPF alignment because the forwarder becomes the envelope sender. DKIM carries it through if the forwarder does not alter the body.

Alignment and OquMail

Mail sent from OquMail mailboxes and through the OquMail API uses your domain in both the Return-Path and the DKIM d= tag, so both identifiers align in relaxed and strict mode. The guided setup publishes SPF, DKIM and DMARC together, and the per-message delivery log shows the remote response so you can spot a DMARC-related rejection quickly.

Common questions

Do I need both SPF and DKIM to align?

No. One aligned pass is enough. Having both gives resilience: if forwarding breaks SPF, DKIM still passes.

Should a small business use strict alignment?

Rarely. Relaxed alignment already blocks the important spoofing case (a completely different domain). Strict mainly matters for large organisations separating brands by subdomain.

What does p=none have to do with alignment?

Nothing directly. Alignment decides pass or fail; the p= policy decides what receivers do with a fail. Start at p=none, review reports, then move to quarantine or reject.