DMARC Alignment Explained: SPF, DKIM, and From Domains
Understand relaxed and strict DMARC alignment by tracing the visible From domain, SMTP MAIL FROM, and DKIM d= value.
Product & Engineering · September 21, 2026 · 3 min read
Before you start
DMARC alignment is the domain-matching step that turns SPF or DKIM authentication into a DMARC pass. A message can have SPF pass and still fail DMARC if the authenticated envelope domain is unrelated to the address recipients see. The same is true of a DKIM signature from a third-party domain. To diagnose alignment, compare three identities: the visible From domain, the SMTP MAIL FROM (usually exposed later as Return-Path), and the DKIM d= domain.
This is a narrower question than what DMARC is. The goal here is to read the domains on one message and decide whether the passing authentication method is also aligned.
The three domains to put side by side
The visible From: header is the address shown in the mail client. In From: Alex <alex@example.com>, the domain is example.com. DMARC treats that domain as the identity that needs protection.
The SMTP MAIL FROM is part of the message envelope. It is used for delivery and bounces and is commonly represented by the Return-Path header after delivery. SPF authenticates the sending host against this envelope domain, not directly against the visible From header.
DKIM adds a signature to the message. The signature's d= tag names the domain that signed it. DKIM authentication asks whether the signature verifies; DKIM alignment asks whether that signing domain is aligned with the visible From domain.
Microsoft's explanation of authentication makes the same distinction between the envelope sender and the user-visible sender. That distinction is why a provider can authenticate a message without proving that it is authorized to use the brand shown in From.
Relaxed versus strict alignment
DMARC has a separate alignment mode for SPF and DKIM. Relaxed alignment is the default in the original DMARC specification. It generally treats a parent domain and its subdomain as aligned when they share the same organizational domain. Strict alignment requires the domains to match exactly.
Consider this message:
From: alerts@example.com
MAIL FROM: bounces@mail.example.com
DKIM-Signature: d=example.com
SPF can pass and align in relaxed mode because mail.example.com and example.com are related domains. SPF would not align in strict mode because the strings differ. DKIM is aligned in both modes here because d=example.com exactly matches the visible From domain.
Now consider:
From: alerts@example.com
MAIL FROM: bounce.vendor-mail.com
DKIM-Signature: d=vendor-mail.com
SPF and DKIM may each authenticate successfully, but neither identifier aligns with example.com. DMARC therefore fails its mechanism check. A provider that sends on your behalf needs a configuration that authenticates with an aligned domain, usually through a custom return path, custom DKIM signing domain, or both. The exact setup is provider-specific; do not copy a record intended for another sender.
The one-of-two rule
DMARC passes when at least one of these combinations succeeds:
- SPF passes and the SPF-authenticated domain aligns with
From. - DKIM passes and the DKIM signing domain aligns with
From.
Both do not have to pass alignment. This matters for forwarding and message modification: SPF can be disrupted in transit while a valid DKIM signature remains aligned. It also means that a DKIM pass from an unrelated provider domain is not enough.
The DMARC RFC describes this as identifier alignment and says receivers evaluate SPF, DKIM, alignment, and then policy. Alignment is not a reputation score and it is not an inbox-placement guarantee. It is a test of whether the authenticated identity is connected to the visible author domain.
A practical header-reading routine
Take a delivered test message and open its original or full headers. Record the following values in the worksheet above:
header.fromor the domain in the visibleFromaddress.smtp.mailfrom,Return-Path, or the envelope sender shown inAuthentication-Results.header.d, the DKIM signing domain.- The result beside each method:
spf=pass,dkim=pass, or a failure/temporary result. - The final
dmarc=passordmarc=failresult, if the receiver reports it.
Do not infer alignment from a green “authenticated” label in a sending dashboard. Inspect the domains on the actual message and test each sending path separately: mailbox mail, forms, marketing tools, and outbound platforms can use different identities.
Where RepMail fits
RepMail users can treat alignment as a pre-send infrastructure check, not as a promise about where a message will land. Before adding a new sender, document its visible From domain, bounce domain, and DKIM signing domain, then verify a test message. The existing sending-domain verification guide covers the product setup context; this article supplies the receiver-side reasoning. For a controlled change, continue with email authentication change management.
Sources
Resources in this guide
| Message identity | Example value | Compare with |
|---|---|---|
| Visible From | sales@example.com | SPF domain and DKIM d= domain |
| SMTP MAIL FROM / Return-Path | bounce@mail.example.com | Visible From for SPF alignment |
| DKIM d= | example.com | Visible From for DKIM alignment |
Common mistakes to avoid
- Treating any SPF or DKIM pass as a DMARC pass without checking the domains.
- Assuming a provider's envelope sender automatically aligns with the visible From domain.
Continue learning
Plan a staged DMARC rollout
Use alignment checks before changing policy for real traffic.