Relaxed vs strict DMARC alignment: choosing adkim and aspf

When strict alignment makes sense#

Strict alignment buys you something in a narrow set of situations:

Untrusted subdomains#

If parts of your domain tree are delegated to other parties, such as a customer-facing subdomain run by a hosting provider, or a university department with its own mail server, relaxed alignment means mail authenticated by those subdomains can pass DMARC for your parent domain's From addresses. Strict alignment prevents that.

Highly sensitive From domains#

A domain used only for a few high-value messages, such as security alerts, with a short, fully controlled sender list, can use strict alignment to rule out any subdomain-based abuse.

Strict on one mechanism only#

Modes are independent. A reasonable pattern for some organizations is strict SPF with relaxed DKIM:

v=DMARC1; p=reject; adkim=r; aspf=s; rua=mailto:[email protected]

SPF identities tend to be the noisier of the two, since many vendors use their own bounce domains anyway, while DKIM keys are under tighter control.

The risk of going strict#

Strict alignment frequently breaks legitimate mail that nobody remembered depended on relaxed alignment:

• A vendor that signs with d=em.example.com stops passing.
• Bounce subdomains stop providing an aligned SPF pass, so DMARC relies entirely on DKIM.
• Mail that previously had two aligned paths now has one, so any DKIM failure becomes a DMARC failure.

If you switch, do it while watching aggregate reports, ideally first at p=none or with a subdomain policy, so you can see which sources lose alignment before enforcement makes it painful.

Checking alignment on a real message#

Read the Authentication-Results header on a received message:

Authentication-Results: mx.receiver.example;
  spf=pass smtp.mailfrom=bounce.example.com;
  dkim=pass header.d=example.com header.s=k1;
  dmarc=pass (p=reject) header.from=example.com

Compare smtp.mailfrom and header.d with header.from. Under relaxed alignment both of these align. Under strict SPF alignment, only DKIM would.

Alignment and the bounce path#

One practical detail often gets missed when teams discuss SPF alignment: the envelope sender is also where bounces go. Providers that use their own bounce domain do so because they need to receive and process delivery failures for you. If you insist on strict SPF alignment, you are effectively asking every provider to use your exact From domain as the envelope sender, which means bounces arrive at your domain and the provider loses visibility into them unless you forward them back.

That is one more reason relaxed SPF alignment, combined with a custom bounce subdomain that points back to the provider, is the standard pattern. It keeps bounce handling with the system that sent the message while still giving DMARC an aligned SPF pass. Strict DKIM alignment does not have this side effect, because DKIM has nothing to do with bounce routing.

A decision checklist#

• Do any vendors sign with a subdomain or use a subdomain bounce domain? Stay relaxed for that mechanism.
• Is any part of your domain tree operated by someone else? Consider strict.
• Is this a narrow, high-value From domain with a tiny sender list? Strict may be worth it.
• Have you reviewed at least two weeks of aggregate reports with the proposed mode in mind? If not, do that first.

Bottom line#

Alignment is the heart of DMARC, and relaxed mode, the default, is the right choice for most domains because it supports bounce subdomains and subdomain signing. Strict alignment helps when subdomains are controlled by other parties or for narrow, sensitive From domains. Whatever you choose, check aggregate reports before and after the change.