DMARC alignment and policy

What it means

DMARC connects message authentication to the domain in the visible From field. It passes when an eligible authenticated SPF or DKIM identifier aligns according to DMARC’s rules; one independent SPF pass or DKIM pass need not be aligned. A published policy communicates the domain owner’s handling preference to receivers, not a guaranteed outcome. DMARC RFC 9989

Try it

Simulation — separate authentication and alignment. Let SPF pass for mail.example.com and DKIM fail: relaxed alignment may let the author example.com pass DMARC when the organizational-domain fixture is known. Switch to strict alignment; an inexact domain will fail. Now make both SPF and DKIM pass for unrelated domains: DMARC still fails. Explore none as a monitoring policy, not a pass result. Reset restores the fixture.

How the mechanism works

First record independent SPF and DKIM authentication results and their authenticated domains. Only a pass can support the corresponding alignment check. Strict alignment requires the authenticated domain to equal the RFC5322.From author domain. Relaxed alignment compares organizational-domain identity under policy discovery rules. Those boundaries are not generally obtained by truncating every name to its last two labels: public suffix rules and explicit domain policies matter. The widget has a small fixed map including demo.example.co.uk and never claims to discover a real organizational boundary.

DMARC passes if one successful identifier aligns, even when the other mechanism fails. If neither passes and aligns, the assessment fails, irrespective of p=none. The published record requests an assessment policy and optional reporting; forwarding and mailing lists can affect authentication/alignment, and local receiver handling remains a separate matter.

A message that passes DKIM but fails SPF

Use a visible From: user@example.com address, an SPF MAIL FROM identity under other.example.net, and DKIM d=example.com:

• SPF might return pass, but its authenticated domain is not aligned with example.com.
• A passing DKIM signature with d=example.com is aligned, so this message can still pass DMARC.
• If DKIM also fails, the DMARC assessment fails despite that separate SPF pass; a published p=none does not convert the result into pass.

Try the strict mode with a subdomain to see why exact equality is different from relaxed organizational-domain alignment. The demo uses an explicit finite mapping, so it cannot infer arbitrary public-suffix boundaries or receiver disposition.

Authentication passes, alignment fails

A message with From example.test might pass SPF for mailer.other.test and DKIM for service.other.test. Both technical checks can be valid for those domains while DMARC fails alignment with example.test. A second message can pass through a forwarding system that breaks SPF but preserves an aligned DKIM signature; DMARC may then pass. p=none does not make the first message pass; it requests a monitoring-oriented policy rather than enforcement. Organizational-domain handling and strict/relaxed alignment follow current DMARC rules, not a simplistic always-two-label extraction. DMARC alignment SPF identity

In practice

Before policy enforcement, enumerate legitimate sending streams and confirm aligned SPF or DKIM on representative traffic. Use verified report data and controlled tests to locate unintended failures. Stop before a broad reject policy if major senders remain unaccounted for; publish a scoped change, monitor results and preserve the previous DNS record and reversal path.

Limits and common mistakes

This is an explicit finite organizational-boundary fixture, not public-suffix discovery, live DNS, ARC interpretation, SPF verification or actual DKIM cryptography. It cannot predict deliverability, receiver policy or reputation filtering. The p field is presented as a request, not a delivered outcome.

Key takeaways

Judge DMARC on aligned authenticated identities, not the count of green SPF/DKIM badges. Policy and receiver action remain separate from authentication and must be validated against actual mail streams.