DMARC alignment requires that the domain validated by SPF or DKIM matches the visible From: domain. Relaxed alignment (the default) allows subdomains of the organizational domain to match; strict requires an exact match. Without alignment, SPF or DKIM can “pass” while DMARC still fails.
A service can pass SPF for its own domain, or sign DKIM with its domain — authentication passes, but if that domain doesn’t align with your From domain, DMARC fails. Alignment is the link DMARC adds on top of SPF and DKIM.
Relaxed (adkim=r, aspf=r) treats mail.yourdomain.com as aligned with yourdomain.com. Strict (s) requires an exact match. Most domains use relaxed; strict is for tightly controlled sending.
Check your DMARC record now
Open the free DMARC checker →Almost always an alignment problem: SPF authenticated a different domain than your From domain. Enable domain-aligned DKIM to fix it reliably.
