DMARC identifier alignment
The rule that SPF or DKIM must pass for the same domain shown in the From line, not just for some domain your provider owns.
See it
What it is
Alignment is the clause that gives DMARC its teeth. A green SPF or DKIM check is worthless if it passed for some other domain, so DMARC demands that the passing domain match the one humans actually see in the From header. SPF aligns when the Return-Path (envelope) domain matches the From domain; DKIM aligns when the signature's 'd=' tag matches it. You need one aligned pass, not both.
This is why a message can show 'spf=pass' and still be rejected. Many providers bounce mail through their own shared Return-Path, something like 'bounces.sendingtool.net', which passes SPF for the tool and aligns with nothing of yours. The fixes are a custom MAIL FROM (branded Return-Path) on a subdomain you control, and DKIM signed with 'd=yourdomain.com' rather than the vendor's domain.
Two details worth knowing. Relaxed mode (the default) accepts any subdomain of the same organizational domain, so 'mail.example.com' aligns with 'example.com'; strict mode demands an exact string match and breaks most real setups. And forwarding destroys SPF alignment while leaving DKIM intact, which is why DKIM alignment is the one you make sure of first.
Ask AI for it
Diagnose DMARC alignment from these raw email headers. Extract three values: the header From domain, the Return-Path / MAIL FROM domain, and the DKIM 'd=' domain. Then state, in a small table, whether SPF aligns and whether DKIM aligns under relaxed mode and under strict mode, and give the overall DMARC verdict. If neither identifier aligns, list the exact fixes: the custom MAIL FROM subdomain and its MX plus SPF records, and the DKIM CNAMEs needed so the signature is made with d=example.com. Assume the sending provider is Amazon SES.