SPF alignment

SPF evaluates the SMTP Mail From identity in the usual non-bounce case. For DMARC, its domain must align with the RFC5322.From domain.

Visible From: example.com
Mail From: bounce.example.com
Relaxed SPF alignment: yes
Strict SPF alignment: no

DKIM alignment

A message can carry multiple DKIM signatures. DMARC needs at least one valid signature whose d= domain aligns with the visible From domain.

Visible From: example.com
DKIM d=: news.example.com
Relaxed DKIM alignment: yes
Strict DKIM alignment: no

Relaxed and strict

Relaxed alignment compares organisational domains. Strict alignment requires an exact domain match. The defaults are relaxed unless adkim=s or aspf=s is published.

Note

Organisational-domain calculation uses the public suffix rules. Simply taking the last two labels is wrong for names such as example.co.uk.

Operational preference

Configure both aligned DKIM and an aligned custom Mail From where your provider supports them. Either can satisfy DMARC, but having both provides resilience when forwarding breaks SPF or content modification breaks DKIM.

Further readingDMARC — RFC 9989