DMARC Alignment (adkim and aspf): Relaxed vs Strict

What relaxed and strict compare

Relaxed alignment requires the two domains to share an organizational domain, determined using the Public Suffix List. Strict alignment requires an exact match.

For SPF, take a message with From: billing@example.com sent with an envelope sender of bounces@mail.example.com. Under relaxed alignment both resolve to the organizational domain example.com, so an SPF pass is aligned and DMARC passes. Under aspf=s the domains differ, so the SPF result cannot satisfy DMARC no matter how clean the SPF record is.

DKIM works the same way against the d= value of the signature. A signature with d=mail.example.com on a message from example.com is aligned under relaxed and not aligned under adkim=s.

DMARC only needs one aligned pass. If DKIM is aligned, it does not matter that SPF failed or was unaligned, and the reverse holds too. This is why DKIM coverage matters more than SPF perfection for surviving forwarding.

Why relaxed is the right default

Relaxed alignment is not a weakness in the way that a permissive SPF mechanism is. It is the intended behavior for the vast majority of senders, and there is a good structural reason for it.

Separating mail streams onto subdomains is normal practice. Transactional mail from mail.example.com, marketing from news.example.com, and alerts from a monitoring subdomain all keep their reputations distinct, which is helpful rather than harmful. Relaxed alignment lets those streams authenticate for the parent domain without forcing every bounce address and signing domain into an exact match.

Third party senders make this concrete. Most email service providers use their own bounce domain, or a subdomain of yours, for the envelope sender. SPF alignment under strict mode fails almost immediately in that setup. The usual remedy, and a good practice regardless, is to have the provider sign with a selector delegated under your domain through a CNAME, so the d= value aligns.

Flagging relaxed alignment as a defect would be wrong. It is worth surfacing so you know what mode you are in, and no more than that.

When strict is worth considering

Strict alignment narrows one specific thing: it prevents a message authenticated by a subdomain from satisfying DMARC for the parent domain. That matters if you have subdomains delegated to teams, vendors, or acquired entities whose DNS you do not fully control. If someone with authority over partner.example.com can create SPF records and DKIM keys there, relaxed alignment lets mail they authenticate pass DMARC as example.com.

If that describes your environment and every legitimate sender for the parent domain signs and bounces from the exact domain, strict alignment is a reasonable tightening. Outside of that case it usually costs deliverability without buying much, since an attacker who already controls one of your subdomains is a larger problem than alignment mode will solve.

How to change it safely

Do not switch to strict and watch what breaks. Work from aggregate reports first.

Go through recent reports and list every source that currently produces an aligned pass. For each, check the exact domains involved: the envelope sender domain for SPF and the d= value for DKIM. Any source where those are subdomains rather than the exact From domain will stop passing under strict.

Fix those first, usually by moving the DKIM signing domain to the exact domain, then set adkim=s, aspf=s, or both. Changing adkim alone is the more common and lower risk step, because DKIM signing domains are under your control in a way that a provider's bounce domain often is not.

# Explicit relaxed (same as the default  - nothing changes)
v=DMARC1; p=reject; adkim=r; aspf=r; rua=mailto:dmarc@example.com

# Strict DKIM alignment only
v=DMARC1; p=reject; adkim=s; rua=mailto:dmarc@example.com

# Both strict  - highest assurance, highest risk of breakage
v=DMARC1; p=reject; adkim=s; aspf=s; rua=mailto:dmarc@example.com

Keep watching reports through the change. Because DMARC only needs one aligned pass, a stream with both SPF and DKIM aligned has margin, but a stream relying on a single method has none.