SPF and DKIM each check a domain, but not necessarily the one your recipient sees in the From line. A spammer can pass SPF for their own domain while showing yours. Alignment closes that gap.
What has to match
| Check | The domain that must match your From domain |
|---|---|
| SPF | The envelope sender, also called the MAIL FROM or Return-Path domain |
| DKIM | The d= domain in the DKIM signature |
DMARC needs only one of the two to be both passing and aligned.
Relaxed and strict
In relaxed mode, the domains match if they share the same organisational domain. mail.example.com aligns with example.com. Strict mode requires an exact match. You set this with the aspf and adkim tags, and relaxed is the default.
Alignment in Amazon SES
This is where most SES senders get stuck.
- DKIM. With Easy DKIM on your own domain, the signature uses your domain, so DKIM aligns. This alone satisfies DMARC.
- SPF. By default SES uses an Amazon domain as the envelope sender, so SPF passes but does not align. To fix it, set up a custom MAIL FROM domain on a subdomain of your sending domain.
DKIM alone is enough for DMARC, but SPF is a useful second chance when a signature breaks, so set up both.
Quick test
Send a test message to a mailbox you control, open the full headers and find the Authentication-Results line. It shows SPF, DKIM and DMARC results, and for each pass, the domain it checked. If the domain is not yours, you have found the problem.
Common questions
Why does DMARC fail when SPF and DKIM both pass?
Because they passed for a different domain than the one in your From address. Pass without alignment does not satisfy DMARC.
Relaxed or strict alignment?
Relaxed, which is the default, lets a subdomain match its parent domain. Strict requires an exact match. Relaxed fits almost every sender.