DMARC alignment connects authentication to the From address.

The DMARC pass rule

DMARC passes when SPF passes and its authenticated domain aligns with the visible From domain, or DKIM passes and its signing domain aligns. Only one aligned path is required. If SPF and DKIM both pass for unrelated provider domains, DMARC can still fail. If SPF breaks during forwarding but an aligned DKIM signature survives, DMARC can still pass.

A compact truth table is useful: aligned SPF pass plus any DKIM result equals DMARC pass; aligned DKIM pass plus any SPF result equals DMARC pass; neither aligned path passing equals DMARC fail. The receiving provider then combines that result and the published policy with its own local handling.

• Aligned SPF passes, DKIM fails: DMARC passes.
• SPF fails, aligned DKIM passes: DMARC passes.
• SPF and DKIM pass but neither aligns: DMARC fails.
• Neither SPF nor DKIM passes and aligns: DMARC fails.

Relaxed alignment is still alignment

Relaxed alignment compares organizational domains, allowing a branded subdomain to align with its parent. Strict alignment requires an exact match. The `aspf` and `adkim` tags control strictness for SPF and DKIM. Relaxed is the default and supports the way most teams separate marketing, transactional, and corporate mail.

Do not change to strict mode because it sounds more secure. First map every legitimate sender and send real tests. Strict alignment can be a valid policy choice, but a forgotten support platform or billing system should not become the discovery mechanism.

Policy and alignment are not the same thing

Alignment determines whether DMARC authentication passes. Policy tells receivers what the domain owner requests for messages that fail: monitor with `p=none`, place suspicious mail with `p=quarantine`, or reject with `p=reject`. Aggregate reporting can begin before enforcement, which is why a careful rollout usually starts with visibility.

A `p=none` policy does not make a passing aligned message weaker. It means the domain is not yet asking receivers to enforce quarantine or rejection on failures. Move toward enforcement when reports show legitimate streams are aligned and unknown sources are understood.

Common SaaS and ESP failure patterns

The common pattern is a brand in the visible From header, a provider-owned return path, and a provider-owned DKIM signature. SPF and DKIM may both pass, but DMARC fails because neither identity aligns. Enable branded DKIM, a custom return path, or both. Another common failure appears when one business unit adds a new platform after the DMARC inventory was completed.

Subdomains can also surprise teams. The organizational relationship may align under relaxed mode, but DMARC policy inheritance and explicit subdomain policy need deliberate handling. Keep a sender register with owner, platform, From domain, return path, DKIM domain, purpose, and last verified date.

Roll out safely, then test placement

Publish a reporting address that is secured and monitored, collect aggregate reports, identify every legitimate source, and configure aligned authentication. Increase policy gradually while watching business-critical streams. Use safe example domains in documentation and never paste real aggregate report data into public tickets without reviewing the IP and domain information it contains.

After DMARC passes, run an inbox placement test with the production sender and template. Alignment can improve trust and prevent spoofing, but it does not compensate for unwanted audiences or poor reputation. A placement test tells you whether the authenticated message still has a provider-specific or message-level problem.