Strict alignment
The DMARC alignment mode in which the authenticated domain must be identical to the From domain, selected with adkim=s or aspf=s.
What it means
With strict alignment, From: news@example.com aligns only with d=example.com for DKIM or a MAIL FROM at example.com for SPF; mail.example.com no longer counts. Each mechanism has its own setting, so a domain can require strict DKIM and relaxed SPF.
It closes a narrow gap: someone able to sign for or send from a subdomain cannot use it to pass for the parent. In exchange, every sending service must authenticate with exactly the From domain. Google's DMARC guide warns that strict alignment can get legitimate subdomain mail rejected or sent to spam.
Most domains should stay on the relaxed default.
Related terms
On this site
Sources
What this definition rests on. The wording is ours; the facts are theirs.
- RFC 9989: Domain-based Message Authentication, Reporting, and Conformance (DMARC), section 3.2.10.2rfc-editor.org
- Google Workspace Admin Help: Set up DMARCknowledge.workspace.google.com
All 432 terms in the glossaryThe wiki: blocklists and bounce codes