What it means
Identifier alignment is the DMARC comparison between the Author Domain and a domain SPF or DKIM has authenticated. The Author Domain is the domain in the visible From. SPF’s authenticated identifier is the domain it checked, usually the MAIL FROM domain. DKIM’s is the signing domain. Alignment is what connects those results to the name a person sees.
Relaxed alignment means the two domains share an organizational domain, the name at the top of that administrative namespace. Strict alignment means the names are identical. RFC 9989 lets the domain owner choose, separately for SPF and DKIM, with aspf and adkim. Both default to relaxed (r). A cousin name that only looks similar does not align. A pass still requires the underlying SPF or DKIM check to pass, not merely a similar string.
AN ILLUSTRATIVE SCENARIO
mail.harbor.example and a lookalike
Notices leave as From finance@harbor.example while DKIM signs as mail.harbor.example. Under relaxed alignment those names can share the organizational domain harbor.example, so a valid signature can produce a DMARC pass. A message from harbor-mail.example does not share that organizational domain. Maya writes “not aligned” instead of “close enough.” Visual similarity is not the check RFC 9989 specifies.
Put it to work
- On a message you may inspect, write the Author Domain, the SPF-authenticated domain, and the DKIM signing domain on three lines.
- Apply the published mode. Relaxed asks whether they share an organizational domain. Strict asks whether the names are identical.
- If a legitimate sender fails alignment, fix that stream’s identity or signature before you tighten policy. Do not treat a lookalike domain as aligned.
How to check your work
Take one synthetic pair, such as mail.harbor.example and harbor.example, and say whether relaxed alignment holds and whether strict alignment holds. Then name a cousin domain that aligns with neither.
Connect the ideas
- DMARC
A DNS policy that checks whether the visible From domain aligns with a domain SPF or DKIM authenticated, and that publishes a handling preference plus reporting. A pass is authorized use of that domain, not a safety verdict.
- SPF
A DNS policy that says which hosts may use a domain in the MAIL FROM or HELO identity. A pass authorizes that host for that identity. It does not prove the visible From address or a person’s intent.
- DKIM
A signature that lets a domain claim responsibility for selected message content, checked with a public key in DNS. A valid signature ties that signing domain to the signed bytes. It does not prove a human wrote the display name.