DKIM alignment
The DMARC condition met when a valid DKIM signature's d= domain matches the From domain, by organizational domain or exactly.
What it means
A message can carry several DKIM signatures; DMARC needs one that verifies and whose d= domain aligns with the From domain under the adkim mode. A valid signature from the sending platform's own domain does not count.
DKIM alignment is the more durable of the two paths. It survives forwarding as long as the signed content is not modified, which SPF cannot do. That is why providers recommend signing with your own domain on every service that sends for you.
To check, read the DKIM-Signature header of a received message and compare d= with the From domain.
Related terms
On this site
Sources
What this definition rests on. The wording is ours; the facts are theirs.
- RFC 9989: Domain-based Message Authentication, Reporting, and Conformance (DMARC), section 4.4.1rfc-editor.org
- Google: Email sender guidelinessupport.google.com
All 432 terms in the glossaryThe wiki: blocklists and bounce codes