Authentication
DMARC alignment
The DMARC check that the domain verified by SPF or DKIM matches the domain in the visible From address. Passing SPF or DKIM isn’t enough on its own; the domains have to align.
Why alignment exists
A spammer can pass SPF and DKIM for their own domain while putting your domain in the From address. Alignment stops that: DMARC only passes when the authenticated domain and the From domain belong together.
SPF alignment vs. DKIM alignment
- SPF aligns when the Return-Path (envelope sender) domain matches the From domain.
- DKIM aligns when the d= domain in the DKIM signature matches the From domain.
- DMARC passes if either one passes and aligns. You don’t need both.
Relaxed vs. strict
By default, alignment is relaxed: mail.yourdomain.com aligns with yourdomain.com because they share the same organizational domain. Strict alignment (adkim=s or aspf=s in your DMARC record) requires an exact match. Relaxed is the right choice for almost everyone.
Alignment and MailCraft
MailCraft signs your mail with a DKIM key for your own domain, so the DKIM signature aligns with your From address, and DMARC passes, from your first send.
Let MailCraft handle the details
Authentication, bounces, complaints and suppression are built in. Start free with 3,000 emails a month, no credit card required.
Start freeRelated terms
Full glossaryAuthentication
DMARC
A DNS policy that tells receiving servers what to do with mail that fails SPF/DKIM alignment (none, quarantine, or reject), and provides aggregate reports on who’s sending as your domain.
Authentication
DKIM (DomainKeys Identified Mail)
A cryptographic signature added to outgoing email that lets receiving servers verify the message really came from your domain and wasn’t altered in transit.
Authentication
Return-Path
The address bounce notifications are sent to, which can differ from the visible "From" address — used by receiving servers to route delivery failures.