DMARC alignment explained
DMARC does not merely ask whether SPF or DKIM passed. It asks whether a passing authenticated identity aligns with the domain shown to the user in the message's From header.
The short version
A message can satisfy DMARC when either SPF passes and aligns, or DKIM passes and aligns. Both do not need to pass.
That alignment is what connects lower-level email authentication to the visible From domain and makes DMARC useful against direct domain spoofing.
SPF alignment
For SPF, DMARC compares the domain used by the authenticated SPF identity with the visible From domain. In relaxed alignment, related organisational domains can align. Strict alignment requires an exact domain match.
A message can therefore pass SPF but still fail DMARC through SPF if the authenticated envelope domain does not align with the visible From domain.
DKIM alignment
DKIM signatures contain a signing domain in the d= value. DMARC compares that signing domain with the visible From domain. Again, relaxed alignment allows an organisational-domain relationship while strict alignment requires an exact match.
This is why DKIM is especially useful when legitimate forwarding breaks SPF: the DKIM signature can remain intact and provide the aligned authentication path instead.
Read a domain's DMARC policy
IPGetter parses the _dmarc TXT record and shows its enforcement policy, alignment modes, reporting addresses and other tags.
What do p=none, quarantine and reject mean?
p=none asks receivers to evaluate DMARC and allows reporting without requesting enforcement. p=quarantine asks receivers to treat failing messages suspiciously, while p=reject asks them to reject messages that fail DMARC.
Receiving systems retain final control over delivery decisions, so the published policy is a request rather than a guarantee of identical behaviour everywhere.
A sensible deployment order
- Inventory legitimate mail sources. Know which platforms send using your domain.
- Get SPF and DKIM healthy. Make sure legitimate services authenticate correctly.
- Publish DMARC with reporting. Start by observing results and fixing unknown senders.
- Increase enforcement carefully. Move toward quarantine or reject when legitimate traffic is consistently aligned.
Prefer the command line?
Inspect DMARC policy and alignment settings from the Terminal.
> dmarc example.com
Run in Terminal ->