What is DMARC alignment?
DMARC alignment is the rule that a passing SPF or DKIM check counts toward DMARC only if its domain matches the visible From address. Relaxed alignment accepts any domain of the same organisation, such as mail.example.com for example.com. Strict alignment needs the exact domain. RFC 7489 §3.1 defines both.
Reading the result
Paste the headers of a message as it arrived. The checker reads the receiving server's Authentication-Results and lists the From domain, the SPF domain (the envelope sender) and every DKIM d= domain, each with its result and whether it aligns under relaxed and strict alignment. Then it gives the DMARC verdict both ways and says which part failed. Nothing you paste leaves your browser.
Common reasons alignment fails
SPF passes for the sending service
Most sending services use their own bounce domain, so SPF passes for theirs and not for yours. SPF aligns only once the Return-Path is on your domain, a setting services call a custom return path or custom MAIL FROM domain.
DKIM signed with the platform’s domain
A signature with d= set to the platform's domain verifies, and still cannot pass DMARC for yours. Publish the DKIM record the platform gives you so it signs as your domain.
Strict alignment and a subdomain
Under adkim=s or aspf=s, mail.example.com no longer aligns with example.com. Unless you need strict, leave both tags out of the record: relaxed is the default (RFC 7489 §6.3).
Forwarding breaks SPF
A forwarded message reaches the final server from the forwarder's IP address, so SPF fails there. Aligned DKIM survives forwarding when the content is left alone, which is why DMARC should not rest on SPF alone.