DMARC Alignment Checker

Verify if your SPF and DKIM domains correctly align with your "From" address domain.

Evidence ASSESSED

Checked against: Identifier alignment between SPF, DKIM and the From domain · RFC 7489 §3.1

RED TEAM 0 findings BLUE TEAM control did not hold

About Alignment

DMARC alignment is the relationship between the domain in the "From" header and the domains validated by SPF and DKIM.

SPF Alignment: The domain in the RFC5321.MailFrom must match the RFC5322.From domain.
DKIM Alignment: The domain in the d= tag of the DKIM signature must match the RFC5322.From domain.
Relaxed vs Strict: Relaxed alignment allows subdomains (e.g., mail.example.com aligns with example.com). Strict alignment requires an exact match.

Our DMARC Alignment Checker examines the adkim and aspf tags in your DMARC record and explains how strict and relaxed alignment affect your mail. Alignment is the step most people miss — a message can pass SPF and DKIM outright and still fail DMARC because neither result aligns with the visible From domain.

What is DMARC Alignment?

Alignment is the requirement that the domain authenticated by SPF or DKIM must match the domain the recipient actually sees in the From header.

This matters because SPF and DKIM validate domains the user never sees. SPF checks the envelope sender, the Return-Path, which is often a bounce domain belonging to your email vendor. DKIM checks the d= tag in the signature, which may equally belong to the vendor. A phisher can pass both while displaying your domain in the From header.

DMARC closes that gap by insisting the authenticated domain and the From domain correspond. A message passes DMARC when at least one of SPF or DKIM both passes and aligns. One aligned pass is enough — they do not both need to succeed.

Requires the authenticated domain to match the visible From domain
SPF alignment compares the From domain with the Return-Path domain
DKIM alignment compares the From domain with the signature d= tag
Only one of the two needs to pass and align for DMARC to succeed
Controlled by the aspf and adkim tags in your DMARC record

Why Alignment Matters

Without alignment, DMARC would be trivially bypassable. An attacker registers a domain, publishes a valid SPF record and DKIM key for it, and sends mail that passes both checks while putting your brand in the From header. The recipient sees your name; the authentication validates the attacker domain.

Alignment is also the most common reason a correctly configured domain still fails DMARC. Email vendors frequently use their own bounce domain for the Return-Path, so SPF passes for the vendor rather than for you. Everything looks green in isolation, yet DMARC fails, and the cause is invisible unless you know to look at alignment specifically.

Prevents attackers passing authentication on a domain they own while displaying yours
The usual reason a well-configured domain still fails DMARC
Third-party senders commonly break SPF alignment by default
Understanding it is a prerequisite for reaching p=reject safely
Relaxed mode permits subdomains; strict mode requires an exact match

How This Alignment Checker Works

The tool reads your DMARC record and reports the alignment mode configured for each mechanism.

Validates the domain input against format and SSRF safety checks
Retrieves the DMARC record at _dmarc.yourdomain.com
Parses the aspf and adkim tags, applying the relaxed default where absent
Retrieves the SPF and DKIM configuration to assess alignment potential
Explains which senders are likely to align and which will not

How to Use the Alignment Checker

Enter your domain name in the input field
Run the check to retrieve your DMARC alignment configuration
Note whether aspf and adkim are relaxed or strict
Review your third-party senders for custom Return-Path configuration
Use DMARC aggregate reports to confirm which sources actually align in practice

Understanding Your Alignment Settings

Two tags control alignment, and each has two possible modes:

Field / Value	Meaning
`aspf=r (relaxed)`	The default. The Return-Path domain must share the organisational domain with the From domain. mail.example.com aligns with example.com.
`aspf=s (strict)`	The Return-Path domain must match the From domain exactly. mail.example.com does not align with example.com.
`adkim=r (relaxed)`	The default. The DKIM d= domain must share the organisational domain with the From domain. Subdomains are acceptable.
`adkim=s (strict)`	The DKIM d= domain must match the From domain exactly, with no subdomain tolerance.
`Organisational domain`	The registrable domain, derived using the public suffix list. For mail.shop.example.co.uk it is example.co.uk. Relaxed alignment operates at this level.
`Pass requirement`	DMARC passes when either SPF or DKIM passes and aligns. Both failing to align means DMARC fails, even if both authenticated successfully on their own terms.

Common Problems & How to Fix Them

Your email vendor is using its own bounce domain as the Return-Path, so SPF authenticates the vendor domain rather than yours.

Configure a custom Return-Path — most vendors call this a custom bounce domain or custom MAIL FROM — so the envelope sender is a subdomain of yours, such as bounce.yourdomain.com. Under relaxed alignment that aligns with your From domain.

If the vendor does not support it, rely on DKIM alignment instead, which is usually easier to achieve with third parties.

The message is signed with the vendor own domain in the d= tag rather than yours.

Set up a branded or custom DKIM key with the vendor, where they sign using a selector under your domain. Nearly every serious email platform supports this, and it is the standard fix for third-party alignment.

With adkim=s or aspf=s, a subdomain sender no longer aligns with the parent domain, so mail from mail.example.com fails for From addresses at example.com.

Unless you have a specific reason for strict mode, use relaxed alignment. It still blocks unrelated domains while tolerating your own subdomains.

DMARC will fail for that source, and at enforcement the mail will be quarantined or rejected.

Identify the source in your DMARC aggregate reports, then fix whichever mechanism is easier for that vendor — custom Return-Path for SPF, or branded DKIM signing. Only one needs to align. Do not weaken your DMARC policy to accommodate a single misconfigured vendor.

Best Practices

Use relaxed alignment for both aspf and adkim unless you have a specific reason not to
Configure custom Return-Path domains with every third-party sender that supports them
Set up branded DKIM signing so vendors sign with your domain rather than theirs
Aim for both SPF and DKIM to align, so one failing does not break DMARC
Read DMARC aggregate reports to confirm alignment in practice rather than in theory
Verify alignment for every sending source before moving to enforcement
Consider strict alignment only once every source is confirmed to align exactly

Security Recommendations

Understand that authentication without alignment offers no protection against impersonation, since an attacker can authenticate their own domain perfectly
Prefer DKIM alignment as the primary path, because it survives forwarding where SPF does not
Audit third-party senders individually — each one aligns or fails to align on its own terms
Never lower a DMARC policy to accommodate an unaligned vendor; fix the vendor configuration instead
Watch aggregate reports for aligned passes from sources you do not recognise, which can indicate a compromised vendor account
Set sp= explicitly so subdomain policy is deliberate rather than inherited by accident

Frequently Asked Questions

Alignment requires that the domain authenticated by SPF or DKIM matches the domain shown in the From header. Without it, an attacker could pass authentication using a domain they own while displaying yours to the recipient.

Relaxed alignment, the default, requires the domains to share an organisational domain, so subdomains align with the parent. Strict alignment requires an exact match. Relaxed is right for most organisations.

Because neither result aligns with your From domain. SPF is probably authenticating your vendor bounce domain, and DKIM is probably signing with the vendor domain in d=. Both pass on their own terms while neither is about your domain.

No. DMARC passes when at least one of them both passes and aligns. Configuring both is still worthwhile, because it gives you a working path when one fails — notably on forwarded mail, where SPF breaks and DKIM survives.

Configure a custom Return-Path, also called a custom bounce domain or custom MAIL FROM, so the envelope sender is a subdomain of yours. Under relaxed alignment that then aligns with your From domain.

The registrable domain, determined using the public suffix list. For mail.shop.example.co.uk the organisational domain is example.co.uk. Relaxed alignment compares at this level, which is what allows subdomains to align with the parent.

Only if you have a specific requirement and have confirmed every sending source matches exactly. Strict mode adds little practical security over relaxed, since relaxed already excludes unrelated domains, and it breaks legitimate subdomain senders.