DMARC alignment and policy

What it means

A message may pass SPF yet fail DMARC because its authenticated SMTP domain does not align with the visible From domain. Conversely, one passing and aligned DKIM signature can be sufficient when SPF fails. It can publish a domain-owner request such as p=none, quarantine or reject, but a receiver still makes its own handling decisions. RFC 9989, published in 2026, supersedes the older RFC 7489/9091 descriptions for this subject.

Try it

Simulation — separate authentication and alignment. Let SPF pass for mail.example.com and DKIM fail: relaxed alignment may let the author example.com pass DMARC when the organizational-domain fixture is known. Switch to strict alignment; an inexact domain will fail. Now make both SPF and DKIM pass for unrelated domains: DMARC still fails. Explore none as a monitoring policy, not a pass result. Reset restores the fixture.

How the mechanism works

First record independent SPF and DKIM authentication results and their authenticated domains. Only a pass can support the corresponding alignment check. Strict alignment requires the authenticated domain to equal the RFC5322.From author domain. Relaxed alignment compares organizational-domain identity under policy discovery rules. Those boundaries are not generally obtained by truncating every name to its last two labels: public suffix rules and explicit domain policies matter. The widget has a small fixed map including demo.example.co.uk and never claims to discover a real organizational boundary.

DMARC passes if one successful identifier aligns, even when the other mechanism fails. If neither passes and aligns, the assessment fails, irrespective of p=none. The published record requests an assessment policy and optional reporting; forwarding and mailing lists can affect authentication/alignment, and local receiver handling remains a separate matter.

A message that passes DKIM but fails SPF

Use a visible From: user@example.com address, an SPF MAIL FROM identity under other.example.net, and DKIM d=example.com:

• SPF might return pass, but its authenticated domain is not aligned with example.com.
• A passing DKIM signature with d=example.com is aligned, so this message can still pass DMARC.
• If DKIM also fails, the DMARC assessment fails despite that separate SPF pass; a published p=none does not convert the result into pass.

Try the strict mode with a subdomain to see why exact equality is different from relaxed organizational-domain alignment. The demo uses an explicit finite mapping, so it cannot infer arbitrary public-suffix boundaries or receiver disposition.

In practice

In an authorized mail environment, read sanitized results for a sample of legitimate senders and identify which MAIL FROM and DKIM signing domains they use. Compare actual organizational-domain discovery and the published DMARC policy using current standard/provider instructions. Start with monitoring and resolve legitimate third-party sources before selecting a more restrictive policy. Stop if alignment failures cannot be attributed or delegated senders are unaccounted for; keep the previous policy and an approved rollback path. Never copy message credentials or private signing keys into a public checker.

Limits and common mistakes

This is an explicit finite organizational-boundary fixture, not public-suffix discovery, live DNS, ARC interpretation, SPF verification or actual DKIM cryptography. It cannot predict deliverability, receiver policy or reputation filtering. The p field is presented as a request, not a delivered outcome.

Key takeaways

A passing SPF or DKIM result is insufficient for DMARC unless the authenticated domain aligns with the author. Strict alignment compares exact domains; relaxed alignment depends on the applicable organizational-domain rules. p=none is an assessment-policy request, not a DMARC pass or a guarantee that mail will be delivered.