Understanding SPF alignment vs DKIM alignment is essential when configuring DMARC for your mail server. Your email may pass SPF or DKIM authentication but still fail DMARC because the authenticated domain does not match the visible sender’s domain.
This distinction matters for SMTP servers, transactional emails, newsletters, and third-party mailing services.
What Does DMARC Actually Check?
DMARC stands for Domain-based Message Authentication, Reporting, and Conformance.
It checks whether the domain in the visible From: address aligns with a domain successfully authenticated by SPF or DKIM.
For example, a message sent from billing@example.com must have at least one authenticated identifier aligned with example.com.
DMARC passes when either SPF or DKIM passes authentication and alignment. Both are not required to pass.
What Is SPF Alignment?
SPF verifies whether the sending server’s IP is authorized for the SMTP envelope sender domain, commonly called the Return-Path domain.
SPF alignment then compares that domain with the visible From domain.
For example:
- From:
billing@example.com - Return-Path:
bounce@mail.example.com - SPF result: Pass
This passes relaxed SPF alignment because both domains share the organizational domain example.com.
However, strict alignment requires an exact domain match.
What Is DKIM Alignment?
DKIM uses a cryptographic signature to verify that signed email content has not been modified improperly.
DKIM alignment compares the signing domain in the d= tag with the visible From domain.
For example:
- From:
billing@example.com - DKIM signing domain:
example.com - DKIM result: Pass
This satisfies both strict and relaxed DKIM alignment.
A valid signature from an unrelated domain may pass DKIM authentication without satisfying DMARC alignment.
SPF Alignment vs DKIM Alignment: Key Differences
| Feature | SPF Alignment | DKIM Alignment |
|---|---|---|
| Identifier checked | Envelope sender domain | DKIM d= domain |
| Authentication method | Sending IP authorization | Digital signature |
| Strict alignment | Exact domain match | Exact domain match |
| Relaxed alignment | Same organizational domain | Same organizational domain |
| Forwarding | Can break SPF | May preserve DKIM |
Relaxed vs Strict DMARC Alignment
DMARC supports two alignment modes:
- Relaxed (
r): Domains share the same organizational domain. - Strict (
s): Domains must match exactly.
The DMARC tags aspf and adkim control SPF and DKIM alignment separately. Both default to relaxed alignment.
For example, an initial monitoring record could be:
v=DMARC1; p=none; aspf=r; adkim=r
The updated IETF DMARC specification (RFC 9989) explains these requirements.
Why Can SPF Pass but DMARC Fail?
This often happens with third-party email services.
A provider may authenticate its own Return-Path domain successfully, while your visible From address uses a different organizational domain.
If DKIM also lacks a valid aligned signature, DMARC fails.
Therefore, configure a custom Return-Path or aligned DKIM signing domain where supported.
How to Verify DMARC Alignment
Send a test email and inspect its authentication results.
Check the SPF result, DKIM result, Return-Path domain, DKIM d= value, and DMARC result.
For self-managed mailing infrastructure, VeltrixHost SMTP VPS Hosting provides root access, Port 25 connectivity, and PTR/rDNS management.
Final Recommendation
For reliable DMARC authentication, configure both SPF and DKIM correctly and aim to align both with your sending domain.
Start with DMARC monitoring, review authentication reports, and resolve legitimate failures before enforcing quarantine or rejection.
FAQs
Does DMARC require both SPF and DKIM to pass?
No. One mechanism must pass authentication and alignment.
Can SPF pass while DMARC fails?
Yes. SPF authentication may succeed for a domain unrelated to the visible From address.
Is relaxed alignment secure?
It is commonly sufficient, but strict alignment may suit organizations requiring tighter domain matching.
