Understanding DMARC Alignment (and Why Your Mail Fails)

DMARC builds on SPF and DKIM but adds a crucial requirement: alignment. A message can pass SPF and DKIM checks yet still fail DMARC if neither authenticated domain aligns with the domain in the visible From header.

SPF alignment compares the From domain with the Return-Path (envelope sender) domain. DKIM alignment compares the From domain with the d= tag in the DKIM signature. In relaxed mode, matching the organizational domain is enough; in strict mode the domains must match exactly.

The practical takeaway: when you move to p=quarantine or p=reject, confirm that at least one of SPF or DKIM aligns for every legitimate mail stream — including third-party senders like your CRM or invoicing platform.