DMARC alignment
The DMARC requirement that the domain SPF or DKIM authenticated matches the From domain, exactly (strict) or by organizational domain (relaxed).
What it means
SPF and DKIM each authenticate a domain, but not necessarily the one in the From address. Anyone can pass SPF for their own domain and send mail claiming to be from yours. DMARC therefore requires identifier alignment: at least one authenticated domain (the SPF MAIL FROM domain or a DKIM d= domain) must relate to the From domain.
Relaxed alignment, the default, needs the two to share an organizational domain: d=mail.example.com aligns with From: example.com. Strict alignment needs them identical. The mode is set separately for DKIM (adkim) and SPF (aspf).
A message passes DMARC if either aligned check passes. One common cause of failure is a third-party platform that passes SPF or DKIM with its own domain instead of yours.
Example
From: news@example.com
DKIM d=mail.example.com -> aligned (relaxed)
SPF MAIL FROM bounce.platform.example -> not alignedRelated terms
On this site
Sources
What this definition rests on. The wording is ours; the facts are theirs.
All 432 terms in the glossaryThe wiki: blocklists and bounce codes