Definition
DKIM alignment is a condition evaluated by DMARC that requires the domain recorded in a message's DKIM signature to match the domain in the From: header. Because DKIM signs the message content with a selector under a specific domain, alignment ensures the domain recipients see is the same domain that cryptographically authenticated the email.
How It Works
A DKIM signature carries a d= tag naming the signing domain, such as d=example.com. When a message arrives, the receiving server verifies the signature's cryptographic validity and extracts the signing domain. It then compares that domain to the From: header domain. If they match under the configured alignment mode, DKIM alignment passes.
DMARC defines two alignment modes via the adkim= tag:
| Mode | Behaviour |
|---|---|
Relaxed (adkim=r) |
The signing domain and From: domain must share the same organisational domain; subdomains are permitted. |
Strict (adkim=s) |
The two domains must match exactly. |
Relaxed is the default. The signing domain can be a subdomain such as marketing.example.com and still align with a From: domain of example.com under relaxed mode.
Why DKIM Alignment Is Preferred
DKIM alignment is more robust than SPF alignment because DKIM survives forwarding and mailing-list redistribution. SPF, by contrast, frequently breaks when a message is relayed, because the receiving IP no longer matches the original sender's SPF record. A valid DKIM signature travels with the message and can still align after forwarding.
For this reason, mailbox providers and deliverability specialists recommend that bulk senders sign with their own domain rather than the domain of their email service provider. Signing with a shared ESP domain produces a passing DKIM check but failing DKIM alignment, which can still cause a DMARC failure.
Example
An e-commerce shop sends a receipt with From: orders@shop.com. Its email platform signs the message with a DKIM signature containing d=mail.shop.com. Because mail.shop.com and shop.com share the organisational domain shop.com, relaxed DKIM alignment passes and DMARC succeeds. If the signature had instead used d=esp-provider.com, DKIM would pass but alignment would fail.
Was this useful?
Related Glossary Terms
Abuse Complaint
An abuse complaint is a report from a recipient who marks an email as spam, which negatively affects sender reputation and deliverability.
Alt Text
Alt text is the written alternative to an image in an email, displayed when images are blocked, slow to load, or consumed by screen readers.
AOL Mail for Email Marketers
AOL Mail is a legacy email provider with specific deliverability requirements and rendering quirks, now operating as part of the Yahoo+AOL network under shared infrastructure.
Email Authentication Protocols
Email authentication protocols are technical standards that verify the identity of an email sender, helping mailbox providers distinguish legitimate mail from spam and phishing.
BIMI
BIMI (Brand Indicators for Message Identification) is an email standard that allows brands to display their logo next to their emails in supported email clients. It requires DMARC enforcement at quarantine or reject policy.
Bounce Management
Bounce management is the process of handling emails that are rejected by mailbox providers, including classification, removal of bad addresses and protection of sender reputation.
Frequently Asked Questions
DKIM passing means the cryptographic signature verifies correctly. DKIM alignment additionally requires the `d=` domain in the signature to match the `From:` header domain. A message signed with the ESP's domain passes DKIM but fails alignment.
It should use a domain you control that shares the organisational domain with your `From:` address. Most email service providers let you add a custom DKIM signature under your own domain, which is required to achieve DKIM alignment.
Yes. A valid DKIM signature remains intact when a message is forwarded, so DKIM alignment typically survives relaying and mailing lists. This is a key advantage over SPF, which often fails after forwarding.
Alignment is set in the DMARC record using the `adkim=` tag, with `r` for relaxed or `s` for strict. DKIM alignment requires that your messages are signed with a domain matching your `From:` address, which usually means publishing a dedicated DKIM record for your sending domain.