DMARC relaxed vs strict alignment: compare the authenticated domains

Define the decision

Alignment is separate from authentication success. Strict alignment requires an exact domain match; relaxed alignment can accept the relevant organizational-domain relationship. Do not infer alignment from similar branding or a matching display name.

Work through the procedure

1. Extract header.from, smtp.mailfrom and each passing header.d value.
2. Evaluate SPF and DKIM alignment independently.
3. Identify legitimate subdomain senders that would fail an exact-match requirement.
4. Test a proposed stricter setting against representative traffic before applying it.

Worked example

The following is a synthetic example for this procedure, not a customer result or performance benchmark.

From: [email protected]
Passing DKIM d=: mail.example.com
Under the assumed example.com organizational domain: relaxed alignment matches; strict alignment does not
Decision: account for this legitimate stream before tightening adkim

Read the result

One aligned passing mechanism can satisfy DMARC, but a stricter setting can remove a previously working path. Record the real domain-discovery result rather than reducing every public suffix to the last two labels.

Check before moving on

1. Include forwarding and vendor-sent messages in the sample.
2. Compare observed receiver results with your expected alignment.

Limits and next action

RFC 9989 updates domain discovery in 2026. Receiver adoption may vary; verify important cases instead of assuming every evaluator has identical behavior.

Source: RFC 9989: identifier alignment