Definition
SPF alignment is a condition evaluated by DMARC that requires the domain in the message's From: header to match the domain authenticated by the SPF check. SPF alone verifies the envelope Return-Path (also called the MAIL FROM) domain, but not the visible From: address. Alignment closes that gap by ensuring the domain recipients actually see is the same domain that passed SPF.
How It Works
When a message arrives, the receiving server performs two separate SPF-related checks. First, it runs a normal SPF validation against the Return-Path domain to confirm the sending IP is authorised. Second, it compares that authenticated domain against the From: header domain. If the two domains match, the message is said to have SPF alignment; if not, SPF alignment fails even though the SPF check itself passed.
DMARC supports two alignment modes, configured with the aspf= tag:
| Mode | Behaviour |
|---|---|
Relaxed (aspf=r) |
The From: domain and the authenticated domain must share the same organisational domain; subdomains are allowed. |
Strict (aspf=s) |
The two domains must match exactly, including any subdomain. |
Relaxed is the default and is generally sufficient for most senders.
Why Alignment Matters
The distinction between SPF passing and SPF alignment is one of the most common causes of DMARC failure. A legitimate sender whose email marketing platform sends from mailer.example.net while the From: header shows example.net will have a passing SPF check but failing SPF alignment, because mailer.example.net does not equal example.net under strict alignment.
Attackers exploit the lack of alignment by using a domain they control in the Return-Path (so SPF passes) while forging a victim's domain in the From: header. SPF without alignment therefore cannot prevent email spoofing. DMARC's alignment requirement is what makes SPF useful as an anti-spoofing control.
Example
A newsletter is sent with Return-Path: bounce@lists.newsletter.com and From: Team <hello@newsletter.com>. The SPF check passes because the sending IP is listed in lists.newsletter.com's SPF record. Under relaxed SPF alignment, the message passes because both domains share the organisational domain newsletter.com. Under strict alignment it fails, since lists.newsletter.com and newsletter.com are not identical.
Was this useful?
Related Glossary Terms
Abuse Complaint
An abuse complaint is a report from a recipient who marks an email as spam, which negatively affects sender reputation and deliverability.
Alt Text
Alt text is the written alternative to an image in an email, displayed when images are blocked, slow to load, or consumed by screen readers.
AOL Mail for Email Marketers
AOL Mail is a legacy email provider with specific deliverability requirements and rendering quirks, now operating as part of the Yahoo+AOL network under shared infrastructure.
Email Authentication Protocols
Email authentication protocols are technical standards that verify the identity of an email sender, helping mailbox providers distinguish legitimate mail from spam and phishing.
BIMI
BIMI (Brand Indicators for Message Identification) is an email standard that allows brands to display their logo next to their emails in supported email clients. It requires DMARC enforcement at quarantine or reject policy.
Bounce Management
Bounce management is the process of handling emails that are rejected by mailbox providers, including classification, removal of bad addresses and protection of sender reputation.
Frequently Asked Questions
SPF passing means the sending IP is authorised by the SPF record of the `Return-Path` domain. SPF alignment additionally requires that the `Return-Path` domain match the `From:` header domain. A message can pass SPF while failing SPF alignment.
SPF alignment is configured in the DMARC record using the `aspf=` tag, set to either `r` for relaxed or `s` for strict. There is no SPF-record setting for alignment; it is purely a DMARC concept.
Yes. This is common when a message is relayed or when an email service provider sends from its own domain in the `Return-Path` while using your domain in the `From:` header. Fixing it usually requires either a custom `Return-Path` domain or relying on DKIM alignment instead.
No. DMARC passes when either SPF or DKIM aligns and authenticates successfully. A sender can rely on DKIM alignment alone if SPF alignment is impractical for their setup.