SPF alignment
The DMARC condition met when SPF passes for a MAIL FROM domain that matches the From domain, by organizational domain or exactly.
What it means
SPF alignment needs two things: SPF must pass, and the domain it passed for (the envelope sender, also seen in Return-Path) must align with the From domain under the aspf mode. A pass for a platform's own bounce domain does not align.
It breaks more easily than DKIM alignment. Forwarding changes the connecting IP address so SPF fails, and many platforms use their own return-path domain unless you configure a custom one. For bounce messages with an empty envelope sender, SPF checks the HELO name, which aligns only if it shares the From domain's organizational domain.
That is why RFC 9989 tells domains at p=reject not to rely on SPF alone.
Related terms
On this site
Sources
What this definition rests on. The wording is ours; the facts are theirs.
- RFC 9989: Domain-based Message Authentication, Reporting, and Conformance (DMARC), section 4.4.2rfc-editor.org
- RFC 9989: Domain-based Message Authentication, Reporting, and Conformance (DMARC), section 3.2.4rfc-editor.org
- RFC 9989: Domain-based Message Authentication, Reporting, and Conformance (DMARC), section 7.4rfc-editor.org
All 432 terms in the glossaryThe wiki: blocklists and bounce codes