What Is DMARC Alignment?
TL;DR
DMARC alignment is the rule that the domain which passed SPF or DKIM must match the domain in the visible From address. A message can pass SPF for a domain the sender controls while displaying your brand in the From header, and alignment is what makes that message fail.
What is the difference between relaxed and strict alignment?
Relaxed alignment requires the two domains to share an organizational domain, so a DKIM signature with d=example.com aligns with a From address at news.example.com. Strict alignment requires the full domain names to match exactly, and that same pair fails.
The tags are adkim for DKIM and aspf for SPF, and each takes r or s. Both default to r, so a DMARC record that does not mention them is using relaxed alignment for both checks.
Why does DMARC pass on either SPF or DKIM?
DMARC needs one aligned pass, not both. That is deliberate, because the two checks fail for different reasons: SPF breaks when a message is forwarded from a server outside the record, while DKIM survives forwarding unless the signed content was modified.
Requiring both would fail a large amount of legitimate mail. Publishing both and letting either one carry the message is the configuration that survives real routing.
What is an organizational domain?
It is the registrable domain one level below a public suffix, so example.co.uk rather than co.uk, and mail.example.com resolves to example.com. Relaxed alignment compares at that level rather than comparing the full names.
This is why a subdomain used for outreach still aligns under a relaxed policy on the parent domain. It is also why alignment cannot be borrowed between two unrelated domains that happen to belong to the same company.
Frequently asked questions
Relaxed, in almost every case. It is the default, and it lets a subdomain send under the organizational domain policy without a separate record. Strict is worth the cost only when you need to stop any subdomain from producing an aligned pass.