Definition
DMARC identifier alignment is the mechanism that links the domain in the RFC 5322 From header with the domains used in SPF and DKIM authentication results. Without alignment, even if SPF or DKIM passes technically, DMARC will fail. Alignment exists in two forms: SPF alignment and DKIM alignment, each of which can be configured in strict or relaxed mode.
Relaxed alignment (the default) allows organisational-domain-level matches. For example, if the From header contains newsletter@example.com and the SPF-authenticated domain is mail.example.com, relaxed alignment passes because both share the example.com organisational domain. Strict alignment requires an exact domain match — mail.example.com cannot align with example.com. This distinction matters enormously for senders using third-party email services, where the sending infrastructure often uses a subdomain different from the visible From domain.
Best Practices
Configure aspf=r (relaxed SPF alignment) and adkim=r (relaxed DKIM alignment) during DMARC initial deployment to minimise authentication failures while you build sending infrastructure. Move to strict alignment only after confirming all legitimate email sources properly authenticate.
Sign all email with DKIM using a d= domain that matches the From header domain. This is the most reliable way to achieve alignment because DKIM travels with the message and survives forwarding, whereas SPF alignment can break when messages are forwarded.
Use separate subdomains for different sending functions (e.g., marketing.example.com, transactional.example.com) and publish separate DMARC policies on each subdomain. This isolates authentication failures and prevents one sending stream from affecting another.
BIMI (Brand Indicators for Message Identification) requires strict DMARC alignment (p=quarantine or p=reject) to display a verified logo. If you plan to adopt BIMI, ensure your alignment configuration meets the BIMI standard before applying.
Monitor DMARC aggregate reports to identify unaligned sending sources. Services like the DMARC aggregate report parser can show you which IP addresses are failing alignment so you can remediate them.
Related Glossary Terms
Bounce Classification
Bounce classification uses SMTP codes (550, 551, 552, 553, 554, 450, 451, 452) and enhanced status codes to categorise permanent and transient delivery failures.
DMARC Policy Tags
DMARC DNS record tags including v, p, sp, rua, ruf, pct, adkim, aspf, fo, rf, and ri control authentication policy, reporting, and alignment enforcement.
Email Active Subscriber
An active email subscriber has opened or clicked an email within a defined recency period, typically 30-90 days by industry. Active subscriber rate of 40-60% is typical for healthy email lists.
Email BIMI VMC
BIMI Verified Mark Certificate (VMC) certifies brand logo ownership for display in supporting email clients. VMCs cost £1,500-2,000+ per year per logo and require DMARC reject or quarantine policy plus SVG logo format.
Email Blacklist
An email blacklist (DNSBL) is a real-time database of IP addresses or domains known for sending spam or unwanted email.
Email Bounce
The return of an undelivered email to the sender, categorized as hard, soft, or transient with distinct handling rules for each.
Frequently Asked Questions
Strict alignment requires an exact domain match between the From header and the SPF or DKIM domain. Relaxed alignment only requires the organisational domain to match, meaning subdomains are acceptable. Relaxed is more forgiving and is recommended during initial DMARC deployment.
DMARC requires either SPF alignment or DKIM alignment to pass. If the authenticating domain does not align with the From header domain, DMARC reports a failure even if SPF or DKIM checks pass independently. Alignment is the bridge between raw authentication and the user-visible From domain.
SPF alignment frequently breaks during forwarding because the original SPF check passes against the forwarder's infrastructure, not the original sender's. DKIM alignment is more resilient to forwarding because the DKIM signature stays attached to the message body and headers, so DKIM alignment is recommended for organisations that expect their email to be forwarded.
BIMI requires strict DMARC alignment with a policy of `p=quarantine` or `p=reject`. Relaxed alignment is not sufficient for BIMI. The domain must also have a DMARC record with a policy that applies to the organisational domain, and the BIMI logo must be hosted at a publicly accessible HTTPS endpoint.
DMARC aggregate reports (sent to the `rua` email address) contain per-record details of authentication results, including whether alignment passed or failed for each message. You can parse these reports using a DMARC report analyser to identify misconfigured or unauthorised sending sources.