🔗

DMARC Alignment Tester

Verify if the "Header From" address properly aligns with the SPF and DKIM authenticated domains.

REQUIREMENT: Strict (s) vs Relaxed (r) Modes
MECHANISM: Domain Matching
IMPACT: Determines overall DMARC Pass/Fail

What is DMARC Alignment Tester?

DMARC alignment analyzes the relationship between the visible "From" address shown to the user in their email client and the unseen domains authenticated via SPF and DKIM.

How it Works

Even if an email passes SPF and DKIM cryptographically, DMARC will STILL FAIL if the domain that signed the email (DKIM `d=` tag) or sent the email (SPF `Return-Path`) doesn't map back to the domain in the visible `From:` header.

Key Use Cases

Troubleshooting why legitimate emails are being rejected by DMARC despite valid SPF/DKIM records.

Configuring MailChimp or SendGrid to send aligned emails instead of using their default unaligned domains.

Auditing multi-tenant architectures.

Advanced Details

In Relaxed mode (`adkim=r`), subdomains can align with parent domains (e.g., `mail.brand.com` aligns with `brand.com`). In Strict mode (`adkim=s`), the domains must match character-for-character.

Cybersecurity Pros & Cons

Security Advantages
  • Alignment enforcement closes the critical gap where SPF/DKIM pass but the user-visible From address is spoofed.
  • Strict alignment (adkim=s, aspf=s) eliminates subdomain-level impersonation attacks that relax mode permits.
  • Alignment testing catches misconfigured third-party senders before they cause DMARC-related delivery failures.
  • Properly aligned emails build domain reputation with major providers, improving long-term deliverability and trust.
Security Limitations
  • Many legitimate third-party email services fail alignment by default, requiring complex per-service DNS configuration.
  • Relaxed alignment mode allows subdomain-to-parent domain matching, which sophisticated attackers can exploit.
  • Strict alignment breaks forwarding scenarios (mailing lists, alumni forwarders) unless ARC is also deployed.
  • DMARC alignment only protects the visible Header From — display name spoofing attacks remain unaddressed.
Ready to Test?

Use our professional-grade tool to perform a real-time check for this module.

Run Module Now
Related Docs