DMARC Alignment Explained: Strict vs Relaxed (adkim and aspf)

DMARC alignment means the domain that passed SPF, or the domain that signed with DKIM, matches the domain in your visible From address. In relaxed mode, which is the default, a subdomain of the same organisational domain counts as a match. In strict mode the domains must be identical. DMARC passes when at least one of SPF or DKIM passes and aligns.

Which domains are compared

• SPF alignment compares the From domain with the envelope sender domain, also called the Return-Path or smtp.mailfrom. This is the bounce address, not the address people see.
• DKIM alignment compares the From domain with the d= domain in the DKIM signature.

Relaxed and strict, side by side

How to set it

The tags are adkim for DKIM and aspf for SPF, each set to r (relaxed) or s (strict). If you leave them out, both are relaxed. Most cold email domains should leave them out. Strict mode adds nothing unless you want to refuse mail from subdomains, and it can break legitimate senders that use a subdomain.

The usual alignment failure in cold email

A sending tool signs your mail with its own domain and uses its own bounce address. SPF and DKIM both pass, but for the tool's domain, so neither aligns with yours and DMARC fails. The fix is in the tool: set up a custom sending or authentication domain so it signs as your domain and uses a bounce address under your domain.