DMARC alignment

Passing SPF or DKIM is not enough for DMARC. The domain that passed must also match the domain in the From header that the reader sees. This match is called alignment. SPF alignment compares the envelope sender (Return-Path) domain with the From domain. DKIM alignment compares the 'd=' domain in the signature with the From domain.

There are two modes. Relaxed alignment (the default) accepts a subdomain of the same organization, so 'mail.example.com' lines up with 'example.com'. Strict alignment needs an exact match. You set the mode in your DMARC record with 'aspf' and 'adkim'.

The classic cold email problem is a sending tool that signs with its own domain and uses its own bounce address. SPF and DKIM both show 'pass', but neither one is aligned, so DMARC fails. The fix is to set up the custom DKIM key and custom return-path domain that the tool offers, so both use your domain. One aligned pass is enough.