What it means
Identifier alignment is the DMARC comparison between the Author Domain and a domain SPF or DKIM has authenticated. The Author Domain is the domain in the visible From. SPF’s authenticated identifier is the domain it checked, usually the MAIL FROM domain. DKIM’s is the signing domain. Alignment is what connects those results to the name a person sees.
Relaxed alignment means the two domains share an organizational domain, the name at the top of that administrative namespace. Strict alignment means the names are identical. RFC 9989 lets the domain owner choose, separately for SPF and DKIM, with aspf and adkim. Both default to relaxed (r). A cousin name that only looks similar does not align. A pass still requires the underlying SPF or DKIM check to pass, not merely a similar string.
The idea at a glance / Email
Same name, subdomain, or lookalike?
Keep From fixed and compare three DKIM signing domains under the two alignment modes.
READ THE PICTURE
Compare the two modes
From stays chronos.orbital. An identical signing domain matches both modes. mail.chronos.orbital shares the illustrative organizational domain and matches relaxed only. chronos-mail.orbital matches neither. DKIM must also validate before this comparison can satisfy DMARC.
Keep in mindThese are name comparisons, not DMARC verdicts. DKIM must also validate. This example assumes chronos.orbital is the organizational domain.
AN ILLUSTRATIVE SCENARIO
mail.chronos.orbital and a lookalike
Notices leave as From finance@chronos.orbital while DKIM signs as mail.chronos.orbital. Under relaxed alignment those names can share the organizational domain chronos.orbital, so a valid signature can produce a DMARC pass. A message from chronos-mail.orbital does not share that organizational domain. Vera writes “not aligned” instead of “close enough.” Visual similarity is not the check RFC 9989 specifies.
Put it to work
- On a message you may inspect, write the Author Domain, the SPF-authenticated domain, and the DKIM signing domain on three lines.
- Apply the published mode. Relaxed asks whether they share an organizational domain. Strict asks whether the names are identical.
- If a legitimate sender fails alignment, fix that stream’s identity or signature before you tighten policy. Do not treat a lookalike domain as aligned.
How to check your work
Take one synthetic pair, such as mail.chronos.orbital and chronos.orbital, and say whether relaxed alignment holds and whether strict alignment holds. Then name a cousin domain that aligns with neither.
Connect the ideas
- DMARC
A DNS policy that checks whether the visible From domain aligns with a domain SPF or DKIM authenticated, and that publishes a handling preference plus reporting. A pass is authorized use of that domain, not a safety verdict.
- SPF
A DNS policy that says which hosts may use a domain in the MAIL FROM or HELO identity. A pass authorizes that host for that identity. It does not prove the visible From address or a person’s intent.
- DKIM
A signature that lets a domain claim responsibility for selected message content, checked with a public key in DNS. A valid signature ties that signing domain to the signed bytes. It does not prove a human wrote the display name.