adkim tag
The DMARC tag choosing relaxed (r, the default) or strict (s) alignment between the DKIM signing domain and the From domain.
What it means
With adkim=r, a DKIM signature from mail.example.com aligns with a From address at example.com, because both have the same organizational domain. With adkim=s, the d= domain must equal the From domain exactly, so only d=example.com aligns with From: news@example.com.
RFC 9989 notes that nearly all domain owners find relaxed alignment sufficient, and Google warns strict alignment can cause mail from legitimate subdomains to be rejected or sent to spam.
Leave adkim out unless you have a specific reason to require exact matches.
Example
v=DMARC1; p=reject; adkim=s; aspf=rRelated terms
On this site
Sources
What this definition rests on. The wording is ours; the facts are theirs.
- RFC 9989: Domain-based Message Authentication, Reporting, and Conformance (DMARC), section 4.7rfc-editor.org
- RFC 9989: Domain-based Message Authentication, Reporting, and Conformance (DMARC), section 4.4rfc-editor.org
- Google Workspace Admin Help: Set up DMARCknowledge.workspace.google.com
All 432 terms in the glossaryThe wiki: blocklists and bounce codes