DMARC Alignment Checker - SPF & DKIM Settings
DMARC alignment connects the domain in an email's visible From address with a domain authenticated by SPF or DKIM. Enter a domain to inspect its published DMARC policy and aspf / adkim alignment settings. This DNS preview cannot determine whether an actual message passed DMARC: that requires the message's verified SPF and DKIM results and authenticated domains.
DNS settings preview - not a message-level alignment test.
This example performs a real DNS lookup for google.com. Results may change. It does not assess your domain or verify message-level email authentication.
What the alignment checker can read
SPF alignment setting (aspf)
Displays the domain's published DMARC SPF alignment mode. When absent, relaxed (r) is the default.
DKIM alignment setting (adkim)
Displays the domain's published DMARC DKIM alignment mode. When absent, relaxed (r) is the default.
DMARC policy (p)
Shows the published requested disposition: none, quarantine, or reject. The policy alone does not prove that any message passed authentication or was delivered.
Related DNS observations
Reports which visible SPF or probed DKIM records were found, without claiming that those records prove a particular message's authentication result.
Not tested: requires a message for message-level results.
How SPF and DKIM alignment actually work
DMARC compares the domain in RFC5322.From (the address visible to a recipient) with an authenticated domain. For SPF, the relevant identity is typically RFC5321.MailFrom / envelope sender. For DKIM, it is the signing domain in the d= tag of a successfully verified signature.
DMARC can pass if either SPF passes and aligns or a DKIM signature verifies and aligns. Both mechanisms do not have to align simultaneously. A published record alone cannot tell you whether this happened for a particular email.
Relaxed vs strict DMARC alignment - worked examples
| Message example | Relaxed alignment (r) | Strict alignment (s) | Why |
|---|---|---|---|
| From alerts@example.com, passing SPF MailFrom bounce.example.com | Aligned | Not aligned | Same organizational domain; exact names differ |
| From alerts@example.com, valid DKIM d=example.com | Aligned | Aligned | Exact signing and From domain |
| From alerts@example.com, SPF passes for provider.example.net and DKIM passes for provider.example.net | Not aligned | Not aligned | The authenticated domains belong to a different organizational domain |
These examples assume the indicated SPF or DKIM authentication results passed. Alignment comparisons alone cannot turn a failed SPF or invalid DKIM signature into a DMARC pass.
Important: Strict mode is not automatically a recommended upgrade. It requires exact domain equality and can make legitimate subdomain mail lose alignment. Verify real sending streams before changing aspf or adkim.
How to investigate "SPF pass, DMARC fail"
- Send a real email from the platform that appears to fail and inspect the authentication results at the receiving mailbox, such as Gmail's "Show original."
- Compare the visible From domain with the SPF-authenticated envelope sender domain and the d= domain of any DKIM signatures that actually verified.
- Check the domain's aspf and adkim settings to see whether relaxed or strict alignment applies.
- If SPF passes for the provider's unrelated domain, consider a provider-supported custom MAIL FROM / Return-Path domain, or a DKIM signing domain aligned with your From address.
- Re-test the real message after configuration changes. Do not change your DMARC policy to p=reject just to fix an alignment mismatch.
Example (not a recommended production record): v=DMARC1; p=none; aspf=r; adkim=r; rua=mailto:dmarc-reports@example.com
This example reporting address does not belong to your organization; configure an address or reporting endpoint you control before publishing.
Further reading: RFC 7489, section 3.1 - Identifier Alignment and DMARC record checker.
How It Works
Enter Your Domain
Type your domain name without http:// or www
We Check All Records
We fetch DMARC, SPF, and probe DKIM selectors
Get Alignment Report
See published aspf and adkim settings. Message results are not tested.
Frequently Asked Questions
Can MXScan verify whether my actual email passes DMARC alignment from DNS alone?
No. This page reads the published alignment settings but cannot test a specific message without its authenticated sending identities and SPF/DKIM verification results.
Why can SPF pass while DMARC fails?
SPF may authenticate an envelope sender domain that is unrelated to the domain in the visible From address. If no successfully verified DKIM signature aligns either, DMARC fails.
Is relaxed DMARC alignment insecure?
Relaxed alignment permits domains under the same organizational domain to align. It is the default in DMARC. Strict alignment requires exact names and may be appropriate in some configurations, but is not universally better for every mail stream.
Does DMARC need both SPF and DKIM to pass?
For a particular message, DMARC can pass when either SPF passes with alignment or a DKIM signature successfully verifies with alignment. Sending-provider requirements may separately call for both SPF and DKIM to be configured.
Monitor Your DMARC Alignment Daily
Get alerts when alignment issues are detected from your DMARC reports.
Start Free Monitoring