# DMARC Alignment Explained: Strict vs Relaxed (adkim and aspf)

URL: https://warmerly.com/blog/dmarc-alignment-strict-vs-relaxed-adkim-aspf
Published: 2026-10-14
Reading time: 5 minutes
Tags: DNS, Authentication, Troubleshooting

> DMARC alignment means the domain that passed SPF or DKIM matches your From domain. Relaxed allows subdomains, strict needs an exact match. With examples.

DMARC alignment means the domain that passed SPF, or the domain that signed with DKIM, matches the domain in your visible From address. In relaxed mode, which is the default, a subdomain of the same organisational domain counts as a match. In strict mode the domains must be identical. DMARC passes when at least one of SPF or DKIM passes and aligns.

> **How this was checked**: The definitions are from RFC 7489, sections 3.1 and 6.3. The examples use example.com, a reserved name. No statistics are used.

## Which domains are compared

- SPF alignment compares the From domain with the envelope sender domain, also called the Return-Path or smtp.mailfrom. This is the bounce address, not the address people see.
- DKIM alignment compares the From domain with the d= domain in the DKIM signature.

## Relaxed and strict, side by side

**Alignment with From: user@example.com**
| Domain that passed | Relaxed (default) | Strict |
| --- | --- | --- |
| example.com | Aligned | Aligned |
| mail.example.com | Aligned, same organisational domain | Not aligned |
| tool-bounces.net | Not aligned | Not aligned |

## How to set it

The tags are adkim for DKIM and aspf for SPF, each set to r (relaxed) or s (strict). If you leave them out, both are relaxed. Most cold email domains should leave them out. Strict mode adds nothing unless you want to refuse mail from subdomains, and it can break legitimate senders that use a subdomain.

## The usual alignment failure in cold email

A sending tool signs your mail with its own domain and uses its own bounce address. SPF and DKIM both pass, but for the tool's domain, so neither aligns with yours and DMARC fails. The fix is in the tool: set up a custom sending or authentication domain so it signs as your domain and uses a bounce address under your domain.

**Check and read more**
- [Free DMARC checker](https://warmerly.com/dmarc-checker)
- [How to read email headers](https://warmerly.com/blog/how-to-read-email-headers-spf-dkim-dmarc)
- [DMARC policy for a cold email domain](https://warmerly.com/blog/dmarc-policy-none-quarantine-reject-cold-email)

---
Source: https://warmerly.com/blog/dmarc-alignment-strict-vs-relaxed-adkim-aspf
Full content index: https://warmerly.com/llms-full.txt
Site index: https://warmerly.com/llms.txt