Definition
DMARC alignment compares the domain in the visible From header with domains authenticated by SPF or DKIM.
How it works
DMARC passes when SPF succeeds with an aligned envelope domain or DKIM succeeds with an aligned d= signing domain. Relaxed alignment permits matching organizational domains; strict alignment requires exact domain matches.
Real-world example
A marketing platform may sign with its own DKIM domain: the signature can be valid while DMARC fails because neither authenticated identifier aligns with the organization's From domain.
Limits and best practices
Review third-party senders and DMARC reports before enabling reject; standalone SPF or DKIM success does not imply DMARC alignment.
Technical detail
DKIM passing does not suffice when its d= domain is not aligned with the visible From header and SPF does not provide an aligned identity. Examine mechanism validation and identifier alignment separately before enforcing a restrictive DMARC policy.