Definition
DMARC alignment (identifier alignment): The DMARC requirement that the domain verified by SPF (the envelope sender) or by DKIM (the d= domain) matches the domain in the visible From header. Relaxed alignment accepts the same organizational domain, such as mail.example.com for example.com; strict alignment needs an exact match.
How SPF alignment and DKIM alignment work
For SPF alignment, the receiver compares the envelope sender domain (the Return-Path) with the From domain. For DKIM alignment, it compares the d= domain in the DKIM signature with the From domain.
Only one of the two needs to pass and align for DMARC to pass. If SPF passes for a domain that does not match, and DKIM is signed by a third party's domain, DMARC fails even though both checks said pass.
Relaxed vs strict alignment
Relaxed alignment, the default, accepts any domain under the same organizational domain. A DKIM signature from mail.example.com aligns with From: news@example.com.
Strict alignment requires an exact match, so mail.example.com would not align with example.com. You set it with adkim=s and aspf=s in the DMARC record. Relaxed suits most organizations, because sending platforms often use a subdomain.
Why mail from your email platform fails alignment
Out of the box, many email platforms send with their own bounce domain in the envelope sender and sign DKIM with their own domain. Both pass, neither aligns with your From domain.
The fix is domain authentication in the platform: a custom return-path on a subdomain you own, and DKIM signing with d= set to your domain, usually set up with a few CNAME records.
Authentication-Results: mx.example.net;
spf=pass smtp.mailfrom=bounces.mailer.example;
dkim=pass header.d=example.com header.s=s2026;
dmarc=pass (p=quarantine) header.from=example.comHow RocketVerifier handles it
Paste a message's raw headers into our free email header analyzer to read its SPF, DKIM and DMARC results and see which domain each check passed for. The DMARC checker shows the alignment modes your record asks for, and the email deliverability checker scores SPF, DKIM and DMARC for the domain in one pass. Monitors recheck SPF, DKIM, DMARC and blocklist status on a schedule and alert you when something changes.