Alignment is the step between "SPF passed" and "DMARC passed". It is a single comparison, and nearly every unexplained DMARC failure is a failure of this comparison rather than of SPF or DKIM themselves.
The comparison
Alignment, in one sentence
The domain that passed a check must match the domain in the From header.
| Check | Domain that passed | Compared against |
|---|---|---|
| SPF alignment | The domain in MAIL FROM | The domain in From: |
| DKIM alignment | The d= tag of a valid signature | The domain in From: |
Each is evaluated independently, and each has its own mode tag — aspf and adkim. A message can be DKIM-aligned and not SPF-aligned, which is completely normal.
Why this is where things break
Both comparisons involve a domain that is frequently not the From domain, for entirely legitimate reasons:
From: billing@acme.com MAIL FROM: bounce-8823@mail.sendingplatform.com <- SPF passes for this d= sendingplatform.com <- DKIM passes for this SPF: pass aligned? no (sendingplatform.com != acme.com) DKIM: pass aligned? no (sendingplatform.com != acme.com) DMARC: FAIL
Nothing is misconfigured in the conventional sense. The platform is authenticating its own mail correctly, using its own domain, which is the default behaviour of most sending platforms until you configure them otherwise. DMARC is correctly reporting that nothing authenticated the address the reader saw.
What fixing it means
There are only three ways to make a third-party sender align, and it is worth knowing them now because the enforcement module is largely an exercise in applying them:
| Approach | How | Result |
|---|---|---|
| DKIM signing with your domain | Provision a key on your domain for the platform — usually a CNAME they give you. | The platform signs with d=acme.com. DKIM aligns. Survives forwarding. Best option. |
| Custom return-path | Configure the platform to use a subdomain of yours as the envelope sender, e.g. bounce.acme.com, and publish SPF there. | SPF aligns under relaxed mode. Does not survive forwarding. |
| Send from a subdomain | Change the From address to @mail.acme.com and treat that subdomain as the platform’s. | Aligns cleanly and isolates reputation. Requires a visible change to the From address. |
Note what is not on that list: adding the platform’s include to your SPF record. That makes SPF pass, and does nothing for alignment, because the envelope domain is still the platform’s. Organisations spend a lot of effort on that step and are then surprised that their DMARC failures are unchanged.
Adding an SPF include is not an alignment fix
It is worth saying twice. If the platform sends with its own envelope domain, your SPF record is not consulted at all — the receiver looks up the platform’s domain. An include in your record has no effect on that message’s alignment whatsoever.
The comparison itself has two modes, relaxed and strict, and the difference between them decides whether a subdomain counts as a match. That is the next lesson. The full reference treatment, including how forwarding changes the answer, is linked at the end — RFC 7489 §3.1 is the normative text.