DMARC Relaxed vs Strict Alignment: adkim and aspf Explained

SPF passes. DKIM passes. And DMARC still fails. If you have stared at that combination in a bounce or an aggregate report, you have met identifier alignment, and the difference between DMARC relaxed vs strict alignment is almost always the reason. Alignment is the extra check DMARC adds on top of SPF and DKIM, and it is the single most misunderstood part of email authentication.

This post explains what alignment is, how the adkim and aspf tags switch it between relaxed and strict, and the exact situations where each mode breaks legitimate mail. It is written against the current standard, RFC 9989, which replaced RFC 7489 in 2026, and every mechanic below is checked against the RFC and Microsoft's own documentation.

The verdict up front#

For almost every domain, use relaxed alignment. It is the default for a reason: relaxed lets a subdomain such as marketing.example.com satisfy DMARC for your main domain, example.com. That is exactly what most email services, marketing platforms and help desks need in order to reach the inbox.

Choose strict alignment only when you control every system that sends as your domain, every one of them authenticates with the exact From domain, and you specifically want to stop any subdomain from vouching for your top-level domain. Strict is a security tightening with a real deliverability cost, and it is the wrong default for the vast majority of senders.

If you are not sure, the answer is relaxed. Reach a p=reject policy on relaxed first, and consider strict only afterwards, with aggregate reports proving that no legitimate mail depends on subdomain matching.

Relaxed vs strict alignment at a glance#

What identifier alignment actually means#

DMARC does not add a new way to authenticate mail. It reuses SPF and DKIM, then adds one rule on top: the domain those checks authenticated must line up with the domain a human sees in the From header. That line-up is identifier alignment.

There are three domains in play, and they are frequently different. The From header domain (RFC5322.From, the P2 sender) is what your mail app shows. The envelope-from domain (RFC5321.MailFrom, also called the Return-Path or P1 sender) is what SPF checks. The DKIM d= domain is what the DKIM signature covers.

SPF alignment compares the envelope-from domain to the From domain. DKIM alignment compares the d= domain to the From domain. DMARC passes if either one aligns and passed; it fails only if both fail. That is why authentication and alignment are two separate pass-or-fail results.

How each mode decides pass or fail#

The only thing relaxed and strict change is how forgiving that comparison is. Relaxed treats two domains as aligned when they share the same organizational (parent) domain. Strict treats them as aligned only when they are identical.

The table below walks a single From address against different authenticated domains, and shows how the same message resolves under each mode.

The last two rows fail both modes because the authenticated domain is a different organizational domain entirely, not just a subdomain. example.onmicrosoft.com and example.com are separate parents, so no amount of relaxing helps.

Where relaxed alignment wins#

Relaxed alignment is the default because it matches how real email is sent. Most organizations do not send everything from one server on one exact domain. They send transactional mail through one service, marketing through another, and support through a help desk, and those services routinely bounce or sign from a subdomain.

A marketing platform that uses a Return-Path of bounces.example.com, or signs DKIM as em.example.com, aligns cleanly under relaxed because both share the example.com parent. Under strict, that same mail fails. Relaxed is what lets you delegate sending to third parties and still reach a p=reject policy without rejecting your own newsletters.

• You use any email service provider, CRM, help desk or transactional service that sends from a subdomain.
• Different teams or products send from different subdomains of one parent domain.
• You are still moving from p=none toward p=reject and cannot risk false failures.
• You are not certain every sender authenticates with the exact From domain — which describes most organizations.

Where strict alignment wins#

Strict alignment earns its place on domains where control is absolute and the stakes are high. If every system that sends as example.com authenticates with example.com exactly, never a subdomain, then strict costs you nothing and closes a small gap.

That gap is this: under relaxed, any host under your organizational domain can produce mail that aligns to your top-level From address. If a marketing subdomain or its DKIM key were ever compromised, relaxed alignment would let mail with From: [email protected] pass DMARC. Strict refuses that; only exact-domain authentication counts, so a subordinate domain cannot vouch for the parent.

• You control every sending source and each one uses the exact From domain.
• The domain is high-value — finance, government, executive communication — and brand-exact spoofing is a real threat.
• It is a parked or transactional-only domain with a single, tightly scoped sender.
• You have already reached p=reject on relaxed and confirmed in aggregate reports that no legitimate mail depends on subdomain matching.

What each mode costs (there is no price tag)#

Neither mode costs money. Relaxed and strict are the same one-character change to a DNS TXT record: adkim=r or adkim=s, aspf=r or aspf=s. The cost is entirely in risk, and the two modes trade opposite risks.

Relaxed carries a small trust cost, because any host under your organizational domain can produce mail that aligns to your top-level From address. Strict carries a deliverability cost, because any legitimate sender that bounces or signs from a subdomain will fail DMARC, and if your policy is p=reject, that mail is rejected outright.

Before you switch to strict, verify rather than assume. Read your own DMARC aggregate (rua) reports for a few weeks and confirm every legitimate source already aligns on the exact domain. Confirm your DNS host actually published the change. And confirm which standard your reporting tool follows, because a tool built on RFC 7489 may still expect the removed pct tag.

Who each mode is genuinely for#

For almost every reader, the honest recommendation is relaxed, and it is not a compromise. Relaxed is the default in the standard, it is what deliverability guidance from Google, Yahoo and Microsoft assumes, and it is the mode that lets a normal mix of senders reach p=reject. If you run marketing, support and product email through outside services, relaxed is simply correct.

Strict is for a narrower group: security-sensitive domains under complete first-party control, parked domains that should never send, and organizations that have already finished a clean relaxed rollout and want defense-in-depth against subdomain abuse. If that is not a precise description of your domain, strict will cost you more in blocked mail than it returns in protection.

Whichever you pick, apply strict to one identifier at a time. Because aspf and adkim are independent, you can set adkim=s while leaving aspf=r, watch your reports, and tighten the second only once the first is clean.

A third option: monitor before you tighten#

If you are stuck choosing between relaxed and strict, there is a better first move than either: measure. The genuine third option is a DMARC monitoring service that collects the aggregate (rua) reports receivers send back and turns the XML into a readable picture of who sends as your domain and whether each source aligns.

Services such as Dmarcian, Valimail, URIports and Postmark's DMARC tool do this, and Microsoft's MISA catalog and dmarc.org list more. None of them change your alignment. They show you the truth before you tighten it, which is the only safe way to move a live domain toward strict or toward p=reject.

AI Emaily is not one of those tools, and it is worth being plain about that. We build AI Emaily, and it is a mail client for the receiving side. It does not publish your DMARC record, monitor your domain, or test your deliverability. What it does with alignment is read it: every message you receive is checked, and the SPF, DKIM and DMARC results in the Authentication-Results header feed its spam and phishing defense, so a message that failed alignment is weighed accordingly instead of being trusted on sender name alone.

So if your question is how to set alignment for your own domain, a DMARC monitoring service is the answer, not us. If your question is how to stop mail that failed authentication from reaching you, that is the job AI Emaily does — see our plans at /pricing.