DMARC Alignment: Strict vs. Relaxed Explained

What is DMARC alignment?

DMARC alignment is the step that decides whether a passing SPF or DKIM result actually counts toward your DMARC policy. It sounds simple. It trips up a lot of people.

When a receiving mail server checks DMARC, it compares two things: the domain in your From header (the address users see) and the domain that SPF or DKIM authenticated. For DMARC to pass, at least one of those authenticated domains must "align" with your From domain.

Alignment is either strict or relaxed. The difference matters.

Relaxed alignment explained

Relaxed alignment (ad=DARC, the default) means the From domain and the authenticated domain must share the same root domain. A subdomain of your root domain counts as aligned.

Example: your From address is newsletter@example.com. Your SPF is authorized on sendgrid.com. Relaxed alignment fails here because sendgrid.com is not a subdomain or exact match of example.com.

Another example: your From address is newsletters@example.com. Your DKIM is signed by dkim.example.com. Relaxed alignment passes because dkim.example.com is a subdomain of example.com.

Relaxed alignment exists to handle legitimate multi-domain setups. If you send from different subdomains of the same root, relaxed alignment keeps your mail flowing without separate authentication records for each subdomain.

The practical catch: relaxed alignment does not solve the third-party sender problem. If a vendor sends email on your behalf using their own infrastructure, their sending domain will not align with your From domain under either mode. That is a different problem requiring a different solution.

Strict alignment explained

Strict alignment (ad=s) requires an exact domain match. The From domain and the authenticated domain must be byte-for-byte identical.

Example: your From address is security@company.com. Your DKIM is signed by company.com. Strict alignment passes because the domains match exactly.

Example: same From address, your DKIM is signed by mail.company.com. Strict alignment fails because mail.company.com is a subdomain, not an exact match.

Strict alignment is safer against spoofing. If someone tries to send mail pretending to be from company.com but their SPF or DKIM authorizes a different domain, strict alignment blocks it. Relaxed alignment might let it through if the domains share a root.

The tradeoff: strict alignment breaks easily if you use any third-party email service that sends from its own domain. Marketing automation platforms, billing systems, and support tools that send email "from" your domain often authenticate with their own infrastructure. With strict alignment, those messages fail DMARC unless you configure them properly.

Which should you choose?

Most organizations start with relaxed alignment. It is the default for a reason. Starting with relaxed gives you room to learn what is actually sending email on behalf of your domain before tightening the policy.

Move to strict alignment when you have full control over every service that sends email from your domain. If you use only in-house mail infrastructure or you have configured third-party services to send through your own mail servers, strict alignment is achievable and more secure.

The intermediate step: many organizations move from p=none to p=quarantine while still using relaxed alignment, then tighten both the alignment mode and the policy once monitoring shows a clean picture.

What you should not do: flip to p=reject with strict alignment without first checking what your DMARC aggregate reports show. The first time strict alignment catches an unauthorized sender you forgot about, those messages disappear. p=quarantine gives you a safety buffer while you clean up.

This is where DMARCFlow becomes part of your decision-making process. When you are deciding whether to move to strict alignment, you need a clear picture of every domain sending as your domain and which ones are currently failing alignment. That data comes from your aggregate reports, and understanding those reports is much easier when they are automatically parsed and flagged. Without that visibility, you are guessing about what will break when you tighten the policy.

Common alignment mistakes and how to fix them

Mistake 1: thinking SPF passing means DMARC will pass. SPF and DMARC are separate checks. Alignment is the bridge. If your SPF passes but the sending domain does not align with your From domain, DMARC fails.

Mistake 2: assuming relaxed alignment handles all legitimate forwarding. Relaxed alignment does not fix forwarding. When a message is forwarded, the From header usually stays the same but the new sending infrastructure has its own SPF and DKIM. Those rarely align with the original From domain. This is why ARC exists, not DMARC alignment.

Mistake 3: using strict alignment before auditing third-party senders. You discover that your billing platform, your product notification system, and your HR software all send from their own domains. Strict alignment means they all fail. Audit first.

Mistake 4: changing alignment mode without changing policy. Relaxed alignment with p=reject is not strict alignment. It still accepts relaxed-aligned mail from any subdomain. If you want the security benefit of exact domain matching, change both the alignment mode and the policy.

Mistake 5: setting alignment mode without monitoring. This is the most common mistake. Organizations change their alignment mode to strict, push to p=reject, and then find out three days later that a critical notification system has been silently failing. Without continuous monitoring of aggregate reports, you will not know what broke until customers call.

How to monitor alignment issues

Alignment failures show up in your DMARC aggregate reports. The reports tell you which domains are sending mail "from" your domain, which alignment mode was used, and whether the results passed or failed.

Reading these reports is the only way to know what is actually sending as your domain before you tighten your policy. DMARCFlow parses these reports automatically and flags alignment failures without requiring you to dig through XML. You get a daily summary of which services are failing, which domains are misaligned, and which ones have suddenly started sending as your domain.

When you see alignment failures in the reports, the question to ask is: is this a legitimate service that needs proper DKIM signing from my domain, or is this something I should block? Over time, your report data builds a map of every service that sends email on your behalf.

This monitoring loop is what makes it safe to move from relaxed to strict alignment. You make the change in p=none, watch what the reports show for a few weeks, fix the legitimate senders that are failing, and only then tighten the policy. DMARCFlow handles the watching part so you do not have to remember to log in and check.

FAQ: DMARC alignment questions

What happens if my DKIM and SPF are on different domains?

DMARC requires only one aligned authentication result. If DKIM passes with aligned domain OR SPF passes with aligned domain, DMARC passes. You do not need both. If neither aligns, DMARC fails.

Can I use strict alignment with third-party senders?

Yes, if those senders sign DKIM with your domain or relay through your mail servers. Many third-party platforms offer custom DKIM signing where they add a DKIM record under your domain. That satisfies strict alignment. If your vendor cannot do this, you need to route their mail through your own SMTP infrastructure.

How do I check if my DMARC alignment is working?

Look at your DMARC aggregate reports. The report shows the "domain alignment" result for each authenticated sender. You want to see "pass" for the domains you control and "fail" for unauthorized senders. If you see failures from services you expected to work, check whether they are authenticating with your domain or their own.

What do DMARC reports show about alignment?

Each record in your aggregate report includes the authentication results (SPF, DKIM) and the alignment result (strict or relaxed). You see the From domain, the responsible domain (the domain that sent the mail), and whether alignment passed or failed. High volumes of alignment failures from a domain you recognize usually mean that service needs reconfiguration.

Does alignment affect email deliverability directly?

Not technically. DMARC is an authentication check, not a reputation signal. But messages that fail DMARC are more likely to be rejected or filtered, especially as major mailbox providers tighten their filtering. Alignment failures that result in DMARC failures do affect deliverability indirectly.

---

DMARC alignment is one of those concepts that seems simple until it is not. The difference between strict and relaxed comes down to whether a subdomain counts as good enough. Relaxed is easier to live with. Strict is safer. The right choice depends on how much control you have over your sending infrastructure.

If you are just starting with DMARC, keep relaxed alignment, set p=none, and spend a few weeks reading your aggregate reports. That gives you the map of who is sending as your domain before you decide how strictly to enforce it.