What is Alignment?
DMARC operates by checking that the organizational domain in the Return Path of the email the "EnvelopeFrom" or "RFC5321.MailFrom" is "aligned" with other authenticated domain names. If either SPF or DKIM alignment checks pass, then the DMARC alignment test passes.
Alignment may be specified as strict or relaxed. For strict alignment, the domain names must be identical. For relaxed alignment, the top-level "Organizational Domain" must match. The Organizational Domain is found by checking a list of public DNS suffixes and adding the next DNS label.
Like SPF and DKIM, DMARC uses the concept of a domain owner, the entity or entities that are authorized to make changes to a given DNS domain.
SPF checks that the IP address of the sending server is authorized by the domain owner that appears in the SMTP MAIL FROM command. (The email address in MAIL FROM is also called the bounce address, envelope-from, or RFC5321.MailFrom.)
In addition to requiring that the SPF check passes, DMARC checks that RFC5321.MailFrom aligns with 5322. from.
Example:
An email is sent with a From address of "abc@example.com" and the Return Path is "mail.example.com". In this case, the email is considered to be SPF-aligned.
An email is sent with a From address of "abc@example.com". and the Return Path is "mail.dmzv.com". In this case, the email is not aligned.
DKIM allows parts of an email message to be cryptographically signed, and the signature must cover the From field. Within the DKIM-Signature mail header, the d= (domain) and s= (selector) tags specify where in DNS to retrieve the public key for the signature.
A valid signature proves that the signer is a domain owner and that the From field hasn't been modified since the signature was applied.
There may be several DKIM signatures on an email message; DMARC requires one valid signature where the domain in the d= tag aligns with the sender's domain stated in the From header field.
Example:
An email is sent with a From address of "abc@example.com". There are two DKIM keys associated with the email, one authenticated signing domain is "mail.dmzv.com" and the other is "example.com". This email is considered to be DKIM-aligned.
An email is sent with a From address of "abc@example.com". There are two DKIM keys associated with the email. One authenticated signing domain is "mail.dmzv.com" and the other is "badexample.com". This email is not considered to be DKIM-aligned.