DMARC Alignment: What It Is, Why Your Emails Fail Without It (and How to Fix It)

If you've set up SPF, DKIM, and DMARC but your emails still fail authentication — or if your DMARC aggregate reports show more failures than you expected — alignment is almost certainly the reason.

DMARC alignment is the piece that trips up most people. Your SPF record can be perfect, your DKIM key can be published and active, and your emails can still fail DMARC because the domain that passed authentication doesn't match the domain your recipients actually see.

Here's what alignment is, how it works, and how to fix it.

What DMARC Alignment Actually Means

Alignment is the bridge between authentication (SPF or DKIM passing) and the visible From address. When a receiving server evaluates your email, it runs three checks:

1. SPF check: Did the sending server's IP appear in the domain's SPF record? (Checks the envelope return-path domain.)
2. DKIM check: Does the DKIM signature verify against the public key, and is the message intact? (Checks the d= domain in the signature.)
3. DMARC alignment: If either SPF or DKIM passed, does the domain they checked match the domain in the From: header your recipient reads?

It's the third step that causes most surprises. SPF or DKIM can pass individually, but if neither aligns with your From domain, DMARC fails.

SPF Alignment vs DKIM Alignment

DMARC gives you two paths to pass: SPF alignment or DKIM alignment. You only need one.

SPF alignment compares the domain in the envelope return-path (the hidden "bounce address") to the domain in the From: header. For alignment to pass under relaxed mode (the default), both must share the same organizational domain — mail.yourcompany.com aligns with yourcompany.com, for instance.

But here's the problem: most email service providers (SendGrid, Mailgun, Amazon SES, HubSpot) set the return-path to their own domain, not yours. SPF passes because the sending IP is authorized — but SPF alignment fails because sendgrid.net doesn't match yourcompany.com.

DKIM alignment compares the d= domain in the DKIM signature to the From: domain. If you sign emails with your own DKIM key (which you should — every ESP lets you publish a custom DKIM selector), the d= domain is your own. DKIM passes, and DKIM alignment passes with it.

In practice, most DMARC-compliant setups rely on DKIM alignment, not SPF alignment. That's normal and it's fine.

Strict vs Relaxed Alignment (adkim and aspf)

DMARC's DNS record lets you control how strictly alignment is enforced with two optional tags:

v=DMARC1; p=reject; adkim=s; aspf=s; rua=mailto:reports@yourdomain.com

Relaxed is the default for both. Most organizations should start with relaxed and only consider strict when they fully understand every sending source.

How to Know If You Have an Alignment Problem

If your DMARC aggregate reports show "fail" entries despite SPF or DKIM passing individually, alignment is the cause. The report tells you exactly which authentication passed but didn't align.

You can also check right now with a free DNS scan. Our scanner checks your live DMARC, SPF, and DKIM records and tells you whether alignment is properly configured — no signup needed.

The Fix

If alignment is failing, there are three paths:

1. Rely on DKIM alignment. Make sure every service sending on your behalf signs with your DKIM key, not a generic key provided by the ESP. Most major ESPs support custom DKIM selectors — publish your own selector._domainkey.yourcompany.com record.

2. Use a custom return-path. Some ESPs let you set a custom return-path that matches your domain instead of theirs. This fixes SPF alignment but is less common than option 1.

3. Add ESP subdomains to relaxed alignment. If your ESP sends from a subdomain you control, relaxed alignment may already handle it — check your reports first.

Once alignment is passing, you can safely move from p=none to p=quarantine and eventually p=reject, knowing that your legitimate mail won't be blocked.

Scan your domain