Alignment has two modes, and they differ on one question: does a subdomain count as a match?
The two modes
| Mode | Tag | Matches when |
|---|---|---|
| Relaxed | adkim=r, aspf=r — the default | The two domains share an organisational domain. |
| Strict | adkim=s, aspf=s | The two domains are identical, label for label. |
From: billing@acme.com d=acme.com relaxed: aligned strict: aligned d=mail.acme.com relaxed: aligned strict: NOT aligned d=acme.co.uk relaxed: NOT aligned strict: NOT aligned d=notacme.com relaxed: NOT aligned strict: NOT aligned
Relaxed is the default, and it is the right default: it lets a platform sign as mail.acme.com or bounce through bounce.acme.com while the message still displays @acme.com. That pattern is how most working deployments are built.
The organisational domain
Relaxed mode needs to know where a domain "begins" — that mail.acme.com belongs to acme.com, but acme.co.uk does not belong to co.uk. DNS itself has no notion of this, so DMARC borrows the Public Suffix List: find the longest suffix on the list, then take one label more.
mail.acme.com public suffix "com" -> acme.com mail.acme.co.uk public suffix "co.uk" -> acme.co.uk foo.bar.acme.com public suffix "com" -> acme.com
This list is maintained by people, not by DNS
The Public Suffix List is a community-maintained file. It is generally accurate and it is occasionally behind reality for newer or unusual TLDs. If alignment behaves strangely on a domain under an obscure suffix, check whether the list agrees with your assumption about where your organisational domain starts.
Which to use
Relaxed unless you have a specific reason. Strict is a meaningful tightening only in a particular situation: an organisation that has delegated subdomains to teams or vendors it does not fully trust. Under relaxed alignment, anyone who can publish DKIM at marketing.acme.com can send mail that passes DMARC displaying @acme.com. Strict alignment closes that.
The BBC runs both tags strict, which is unusual and coherent for an organisation with many delegated subdomains:
"v=DMARC1;p=reject;aspf=s;adkim=s;pct=100;fo=0;ri=86400; rua=mailto:dmarc_agg@vali.email;"
The cost is that every sender must align on the exact domain. A platform signing with d=mail.bbc.co.uk would fail, where under relaxed it would pass. That is a real operational burden and it should be a deliberate choice, not a default someone tightened because stricter sounded better.
A concrete trap: Microsoft 365 DKIM
A tenant that has not enabled DKIM for its custom domain signs with the tenant’s onmicrosoft.com domain instead:
From: someone@acme.com d= acme-com.onmicrosoft.com relaxed: NOT aligned — the organisational domain is onmicrosoft.com, not acme.com strict: NOT aligned
DKIM passes. Authentication-Results shows dkim=pass. DMARC fails, under either mode, because the signing domain is Microsoft’s rather than yours. The fix is to enable DKIM for the custom domain in the tenant, which publishes the two CNAMEs you saw in the selectors lesson. Both platform guides linked at the end of this lesson cover the exact steps.
RFC 7489 §3.1.1 is the normative text for relaxed and strict comparison if you want the precise wording.