Alignment
When the domain that passed SPF or DKIM matches the domain in your From line (what the inbox shows).
Say it out loud
“The check that what we proved is actually about us. This is the one that fails while everything else looks fine.”
Alignment asks whether the domain that authenticated is the same organisation's domain as the one in the From line. Mail can pass DKIM outright while DMARC still fails, because the valid signature belongs to your platform rather than to you. It is the most common cause of a message that sits in spam while every dashboard reports success.
Passed. But it vouched for the vendor's envelope domain.
Passed. But the signature is the vendor's, not yours.
And there it is. Nothing that passed belongs to aurora.com, so nothing vouched for the name in the inbox.
Both checks passed. DMARC still failed. Relaxed alignment accepts a subdomain (mail.aurora.com for aurora.com); strict requires an exact match.
Part yours
The platform does part; the rest is genuinely yours.
What goes wrong
Onboarding a new tool — a review platform, a survey tool, a helpdesk — that sends as your domain and signs with its own. Everything reports pass, DMARC quietly fails, and nobody looks until the numbers move.
Not the same as
- DKIM passing
- Passing means the signature is valid. Aligned means it is valid and belongs to your From domain. Only the second one satisfies DMARC.
Check it yourself
DNS cannot prove alignment. A received message can — paste its headers
Run it now →The dated rules behind this
A definition is not a citation. These are the pages with the primary source, the date it was published, and what to do about it.
See also
Where this sits
Stop 4, identity gets checked. The receiver works out whether the message really comes from who it says it does.