auth.dmarc.alignment_mode
DMARC Alignment Mode
What we check
We read the adkim= and aspf= tags, which set how strictly DMARC requires the DKIM and SPF domains to match the visible From: domain. r (relaxed, the default) accepts subdomains of the same organizational domain; s (strict) requires an exact, character-for-character match.
What this finding means
This is an informational finding that reports the domain's alignment configuration — it is neither a pass nor a failure. DMARC only passes when a passing SPF or DKIM result is also aligned with the From: domain. The alignment mode decides how forgiving that comparison is.
- Relaxed (
r) — the recommended default.From: user@example.comaligns with a DKIMd=mail.example.comor an SPF Return-Path atbounce.example.com, because all share the organizational domainexample.com. This is what third-party senders (marketing, CRM, ticketing) almost always need, since they sign or bounce through their own subdomains. - Strict (
s) — exact match only.From: user@example.comaligns only with DKIMd=example.comand an SPF Return-Path exactly atexample.com. A valid signature frommail.example.comfails alignment.
When to use strict
Strict alignment is for high-assurance environments — financial, government, high-value B2B — where you must prevent a compromised subdomain from authenticating traffic for the root domain. It only works if every legitimate sender aligns exactly, so verify that in your aggregate reports before switching.
How it's graded
Alignment mode is informational and carries no point deduction. See Grading Methodology for the full scoring model.
Evidence example
$ dig +short TXT _dmarc.example.com
"v=DMARC1; p=reject; adkim=s; aspf=s; rua=mailto:dmarc-reports@example.com"
^^^^^^^^^^^^^^^^ strict alignment for both DKIM and SPF