Definition
DMARC identifier alignment is the mechanism that links the domain in the RFC 5322 From header with the domains used in SPF and DKIM authentication results. Without alignment, even if SPF or DKIM passes technically, DMARC will fail. Alignment exists in two forms: SPF alignment and DKIM alignment, each of which can be configured in strict or relaxed mode.
Relaxed alignment (the default) allows organisational-domain-level matches. For example, if the From header contains newsletter@example.com and the SPF-authenticated domain is mail.example.com, relaxed alignment passes because both share the example.com organisational domain. Strict alignment requires an exact domain match — mail.example.com cannot align with example.com. This distinction matters enormously for senders using third-party email services, where the sending infrastructure often uses a subdomain different from the visible From domain.
Best Practices
Configure aspf=r (relaxed SPF alignment) and adkim=r (relaxed DKIM alignment) during DMARC initial deployment to minimise authentication failures while you build sending infrastructure. Move to strict alignment only after confirming all legitimate email sources properly authenticate.
Sign all email with DKIM using a d= domain that matches the From header domain. This is the most reliable way to achieve alignment because DKIM travels with the message and survives forwarding, whereas SPF alignment can break when messages are forwarded.
Use separate subdomains for different sending functions (e.g., marketing.example.com, transactional.example.com) and publish separate DMARC policies on each subdomain. This isolates authentication failures and prevents one sending stream from affecting another.
BIMI (Brand Indicators for Message Identification) requires strict DMARC alignment (p=quarantine or p=reject) to display a verified logo. If you plan to adopt BIMI, ensure your alignment configuration meets the BIMI standard before applying.
Monitor DMARC aggregate reports to identify unaligned sending sources. Services like the DMARC aggregate report parser can show you which IP addresses are failing alignment so you can remediate them.
Related Glossary Terms
AI Content Detection
AI content detection refers to the growing ability of email clients, spam filters and consumers to identify machine-generated email copy. It matters for deliverability, trust and engagement in an era of mass-produced AI marketing email.
Email Authentication Protocols
Email authentication protocols are technical standards that verify the identity of an email sender, helping mailbox providers distinguish legitimate mail from spam and phishing.
Batch Sending
Batch sending is the practice of delivering a single email campaign to a large list in groups or waves rather than all at once.
Bounce Classification
Bounce classification uses SMTP codes (550, 551, 552, 553, 554, 450, 451, 452) and enhanced status codes to categorise permanent and transient delivery failures.
Complaint Rate
Complaint rate is the percentage of delivered emails that recipients mark as spam, a key indicator of sender reputation and list quality.
DMARC Policy Tags
DMARC DNS record tags including v, p, sp, rua, ruf, pct, adkim, aspf, fo, rf, and ri control authentication policy, reporting, and alignment enforcement.
Frequently Asked Questions
Strict alignment requires an exact domain match between the From header and the SPF or DKIM domain. Relaxed alignment only requires the organisational domain to match, meaning subdomains are acceptable. Relaxed is more forgiving and is recommended during initial DMARC deployment.
DMARC requires either SPF alignment or DKIM alignment to pass. If the authenticating domain does not align with the From header domain, DMARC reports a failure even if SPF or DKIM checks pass independently. Alignment is the bridge between raw authentication and the user-visible From domain.
SPF alignment frequently breaks during forwarding because the original SPF check passes against the forwarder's infrastructure, not the original sender's. DKIM alignment is more resilient to forwarding because the DKIM signature stays attached to the message body and headers, so DKIM alignment is recommended for organisations that expect their email to be forwarded.
BIMI requires strict DMARC alignment with a policy of `p=quarantine` or `p=reject`. Relaxed alignment is not sufficient for BIMI. The domain must also have a DMARC record with a policy that applies to the organisational domain, and the BIMI logo must be hosted at a publicly accessible HTTPS endpoint.
DMARC aggregate reports (sent to the `rua` email address) contain per-record details of authentication results, including whether alignment passed or failed for each message. You can parse these reports using a DMARC report analyser to identify misconfigured or unauthorised sending sources.