A sender can prove control of its own domain. It can still display your domain in the From address. Successful authentication alone does not establish permission to use that displayed identity.
Why can SPF and DKIM pass while DMARC fails?
Both checks can authenticate domains that do not match the visible From domain.
SPF checks whether the connecting server is authorized for the envelope sender domain used for delivery-failure notices. DKIM validates a cryptographic signature associated with a signing domain, identified by the signature's d tag.
The envelope sender is supplied during the SMTP conversation. It is separate from the From header displayed by the recipient's mail client.
For example, a sender controlling attacker.example can pass SPF and DKIM for that domain. The sender can put billing@example.com in From. Neither result validates example.com, so DMARC fails.
An organizational domain is the administrative boundary containing a domain and its subdomains, such as example.com for news.example.com.
What counts as aligned?
Relaxed alignment requires a shared organizational domain. Strict alignment requires identical domains.
RFC 9989 defines how receivers discover that boundary.
| Authenticated domain | From domain | Alignment |
|---|---|---|
foo.example.com | news.example.com | Relaxed, because both share example.com |
news.example.com | news.example.com | Strict, because the domains are identical |
foo.example.net | news.example.com | Neither, because the organizational domains differ |
The adkim tag controls DKIM alignment. The aspf tag controls SPF alignment. Each accepts r for relaxed or s for strict, with relaxed as the default.
Use strict alignment only when you need identical domains, because it excludes otherwise valid matches between sibling subdomains. A service signing as foo.example.com cannot satisfy strict alignment for From at news.example.com.
The specification reports that nearly all domain owners find relaxed alignment sufficient. Your domain-matching requirements determine whether relaxed alignment is appropriate.
Does DMARC need both methods to align?
No: an aligned pass from either SPF or DKIM is sufficient.
The receiver evaluates the methods independently. A passing but unaligned result cannot supply the DMARC pass.
Forwarding can break SPF by changing the connecting server. DKIM can survive if the forwarder preserves the signed content. An intact signature from an aligned domain then lets the message pass DMARC despite the SPF failure.
If forwarding changes signed content, DKIM can fail as well. How to fix DMARC failures explains the diagnosis.
Why can a sending service break SPF alignment?
SPF alignment fails when the service uses an envelope sender domain that does not align with your visible From domain.
If the service uses its own unrelated bounce domain, SPF can pass for that domain. DMARC rejects that result as unaligned. Adding the service to an SPF record on your domain does not change the domain the receiver checks.
Configure a custom return path, the domain used for delivery-failure notices, under your own domain. Under relaxed alignment, bounce.example.com can match From at example.com.
DKIM offers a separate route: configure the service to sign using an aligned domain. You can confirm both results in aggregate reports, which summarize the receiver's checks.
How do you configure the return path with Bird?
You publish Bird's return-path alias under your sending domain.
Publish that alias as a CNAME record. The return-path alias supplies Bird's SPF setup, so you need no separate SPF record at the domain root for Bird sends.
The API's return_path.name field accepts 1 to 63 letters, digits or hyphens, with a letter or digit at each end. A longer label or one beginning with a hyphen is invalid.
Bird appends your sending domain. For example, send on mail.example.com becomes send.mail.example.com. That return path can align with From at mail.example.com in relaxed mode.
The bounce-domain guide covers the record. You also publish the DKIM record. Bird accepts a valid DMARC policy on either the sending domain or its organizational domain. A monitoring policy of p=none, which expresses no handling preference for failures, is sufficient.
How does the specification find organizational domains?
RFC 9989 searches the domain hierarchy for records that establish the applicable policy and domain boundary. This search is called a DNS tree walk.
The specification replaces the Public Suffix List approach described by RFC 7489. That list identifies shared registration suffixes such as com and co.uk.
The distinction affects relaxed alignment because the discovered organizational domain determines whether related names match. It also affects which parent policy applies to a subdomain. A published specification does not establish which discovery method a particular receiver implements.
Can a percentage tag control enforcement?
The pct percentage tag does not provide dependable partial enforcement. RFC 9989 excludes it.
Appendix A.6 describes inconsistent handling of intermediate percentages. A setting of pct=50 therefore cannot assure you that stricter handling affects exactly half of failing messages.
The exceptional values were zero and one hundred, corresponding to no percentage-based enforcement and full enforcement. Some intermediaries also treated pct=0 as a signal to rewrite the visible From address to avoid downstream failures.
Use reports to repair legitimate failures before changing the policy through none, quarantine and reject. The value none expresses no handling preference. The value quarantine marks failures as suspicious. The value reject identifies unauthorized domain use. The policy guide explains rollout.
Does an aligned pass prove that the message is safe?
An aligned pass proves authorized use of the From domain, without establishing whether the message is wanted or safe.
A receiver can reject or quarantine a passing message using its own filtering rules. It can also accept a failing message when other evidence supports delivery.
Domain authorization and sender reputation, the receiver's assessment of a sender's traffic, answer different questions. Check both when investigating delivery.
In short
Authentication must match the visible domain.
SPF and DKIM can pass for unrelated domains, so DMARC requires an aligned pass for the domain in From.
Either aligned method can supply a pass.
An intact aligned DKIM signature can preserve a DMARC pass when forwarding breaks SPF.
Relaxed and strict use different matching rules.
Relaxed alignment accepts a shared organizational domain. Strict alignment requires identical domains.
Domain discovery and enforcement are separate mechanisms.
RFC 9989 uses a DNS tree walk to discover domain boundaries. It excludes the unreliable percentage tag from its policy format.