--- title: "How does DKIM alignment affect overall DMARC compliance? | DuoCircle" description: "How does DKIM alignment affect overall DMARC compliance?" image: "https://www.duocircle.com/images/og-default.png" canonical: "https://www.duocircle.com/blog/dmarc/how-does-dkim-alignment-affect-overall-dmarc-compliance/" --- Quick Answer DMARC passes when SPF or DKIM passes and aligns with the From-header domain. DKIM alignment compares the d= value in the DKIM-Signature header to the From domain. Two modes exist: relaxed (default) requires the same organizational domain (mail.example.com aligns with example.com), while strict requires an exact match (mail.example.com fails for example.com, but example.com matches example.com). DKIM alignment is often more reliable than SPF alignment because DKIM survives forwarding and does not depend on changing IP addresses. Third-party senders typically sign with d=thirdparty.com by default, which fails DKIM alignment for your domain; configure them to sign with d=yourdomain.com instead. If both SPF and DKIM fail alignment, the message fails DMARC and is handled per your policy. How does DKIM alignment affect overall DMARC compliance? Your browser does not support the audio element. [ Download episode](https://media.mailhop.org/duocircle/images/2025/02/How-does-DKIM-alignment-affect-overall-DMARC-compliance.mp3) Share [ ](https://www.linkedin.com/sharing/share-offsite/?url=undefined%2Fblog%2Fdmarc%2Fhow-does-dkim-alignment-affect-overall-dmarc-compliance%2F "Share on LinkedIn") [ ](https://twitter.com/intent/tweet?text=How%20does%20DKIM%20alignment%20affect%20overall%20DMARC%20compliance%3F&url=undefined%2Fblog%2Fdmarc%2Fhow-does-dkim-alignment-affect-overall-dmarc-compliance%2F "Share on X/Twitter") [ ](https://www.facebook.com/sharer/sharer.php?u=undefined%2Fblog%2Fdmarc%2Fhow-does-dkim-alignment-affect-overall-dmarc-compliance%2F "Share on Facebook") [ ](https://reddit.com/submit?url=undefined%2Fblog%2Fdmarc%2Fhow-does-dkim-alignment-affect-overall-dmarc-compliance%2F&title=How%20does%20DKIM%20alignment%20affect%20overall%20DMARC%20compliance%3F "Share on Reddit") [ ](mailto:?subject=How%20does%20DKIM%20alignment%20affect%20overall%20DMARC%20compliance%3F&body=Check out this article: undefined%2Fblog%2Fdmarc%2Fhow-does-dkim-alignment-affect-overall-dmarc-compliance%2F "Share via Email") ![DKIM alignment](https://media.mailhop.org/duocircle/images/2025/02/spf-record-checker-5432.jpg) [DMARC](/resources/what-is-dmarc) is based on SPF and DKIM results. For an email to pass the DMARC checks, it has to pass at least one of the protocols and have **alignment with the domain** in the ‘From’ header. [DKIM alignment](/email-security/what-is-dkim-alignment-how-does-it-impact-dmarc/) happens when the domain used in the DKIM signature (d= domain) matches the domain in the ‘From’ address of the email. When an email is signed with DKIM, the sender adds a digital signature that includes a domain (d=), which is used to **verify the email’s authenticity**. Example- DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=example.com; s=selector1; h=from:subject:date; In the above example, d=example.com is the domain **signing the email**. ## Types of DKIM alignment The two types of DKIM alignment are- relaxed (default) and strict. ### Relaxed alignment If you have set your DKIM record to the relaxed alignment, then the [DKIM](/resources/what-is-dkim) domain (d=) must share the same organizational domain as the one in the ‘From’ domain. Let’s say the ‘From’ **address is [user@example.com](mailto:user@example.com)**, and the DKIM signature domain is mail.example.com, then the relaxed alignment will pass. ### Strict alignment If your DKIM record is **set to the strict alignment**, the DKIM domain (d=) must be an exact match to the ‘From’ domain. If the ‘From’ **address is [user@example.com](mailto:user@example.com)** and the [DKIM signature](https://docs.mapp.com/v1/docs/dkim-signature) domain is mail.example.com, then the strict alignment will fail. But if the DKIM signature domain is example.com, the strict alignment will pass. [![DKIM Signature Domain ](https://media.mailhop.org/duocircle/images/2025/02/dmarc-report-9999.jpg)](https://media.mailhop.org/duocircle/images/2025/02/dmarc-report-9999.jpg) ## Impact of DKIM alignment on DMARC compliance When an email sent from your domain passes the DKIM authentication and is aligned, it passes DMARC even if SPF fails or lacks alignment. This helps emails sent on your behalf through [third-party](https://www.investopedia.com/terms/t/third-party.asp) services to pass the DMARC. If these services sign emails with their own DKIM keys (d=thirdparty.com), then DKIM alignment will fail unless you have explicitly configured them to use the **sender’s domain (d=example.com)**. SPF alignment might also fail if the email is sent from the third-party’s [mail server](https://www.techtarget.com/whatis/definition/mail-server-mail-transfer-transport-agent-MTA-mail-router-Internet-mailer). Also, if your organization’s [email infrastructure](https://www.voilanorbert.com/blog/email-infrastructure/) includes **multiple and intricate servers**, then DKIM alignment ensures unhampered delivery. However, if DKIM alignment and SPF authentication fail for an email, it will not pass DMARC at all. Such an email will either be [marked as spam](https://pressgazette.co.uk/publishers/digital-journalism/facebook-spam-posts-independent-small-news-publishers/) or get rejected by the **recipient’s mailbox**. [![spam](https://media.mailhop.org/duocircle/images/2025/02/sender-policy-framework-5432.jpg)](/dmarc/how-does-dkim-alignment-affect-overall-dmarc-compliance/attachment/scam-alert-network-and-internet-security-hacker-attack-and-web-security-vector-concept-phishing-scam-spam-email-message-distribution-malware-spreading-virus-vector-illustration) ## Best practices for ensuring DKIM alignment - Whenever you use third-party services to send emails, configure them to **use d=example.com instead of d=thirdparty.com**. - Use relaxed DKIM alignment if you have just implemented DKIM for your domain. This allows subdomains to align and prevent unnecessary failures. - Choose to receive DMARC aggregate reports as they give insights into [email authentication](/resources/email-authentication) activities, including misalignment issues. - Consider DKIM over SPF for alignment because the former is more resilient and efficient as it doesn’t rely on IP addresses. IP addresses can change if the [range is dynamic](https://en.wikipedia.org/wiki/Dynamic%5Frange) or you/someone forwards emails. We at [DuoCircle](/) can help you start or manage your email authentication journey. [Contact us](/contact) for our **expert guidance and result-driven services**. ## Topics DKIMDMARCspf ![Brad Slavin](https://media.mailhop.org/dmarcreport/images/team/brad-slavin.jpg) Brad Slavin General Manager General Manager at DuoCircle. Product strategy and commercial lead across the email security portfolio. ## Secure your email infrastructure Protect, authenticate, and deliver. Contact our team to find the right solution. [Contact Sales](/contact/) [Explore Products](/products/) Share this article [ ](https://www.linkedin.com/sharing/share-offsite/?url=https%3A%2F%2Fwww.duocircle.com%2Fblog%2Fdmarc%2Fhow-does-dkim-alignment-affect-overall-dmarc-compliance%2F) [ ](https://twitter.com/intent/tweet?text=How%20does%20DKIM%20alignment%20affect%20overall%20DMARC%20compliance%3F&url=https%3A%2F%2Fwww.duocircle.com%2Fblog%2Fdmarc%2Fhow-does-dkim-alignment-affect-overall-dmarc-compliance%2F) [ ](https://www.facebook.com/sharer/sharer.php?u=https%3A%2F%2Fwww.duocircle.com%2Fblog%2Fdmarc%2Fhow-does-dkim-alignment-affect-overall-dmarc-compliance%2F) Copy Related Articles - [ ![DMARC expert](https://media.mailhop.org/duocircle/images/2024/09/dmarc-report-5.jpg) How to become a DMARC expert: a 6-step learning path DMARC ](/blog/dmarc/a-detailed-guide-on-becoming-a-dmarc-expert/) - [ ![DMARC problems](https://media.mailhop.org/duocircle/images/2024/10/email-migration-service-8520.jpg) A guide to detecting DMARC problems using the pentesting techniques DMARC ](/blog/dmarc/a-guide-to-detecting-dmarc-problems-using-the-pentesting-techniques/) - [ ![BIMI](https://media.mailhop.org/duocircle/images/2025/06/spf-permerror-0123.jpg) Avoiding common BIMI pitfalls: What goes wrong and how to fix it DMARC ](/blog/dmarc/avoiding-bimi-pitfalls-common-errors-and-how-to-fix-them/) - [ ![Can threat actors bypass DMARC](https://media.mailhop.org/duocircle/images/2025/02/dmarc-generator-7302.jpg) Can threat actors bypass DMARC? DMARC ](/blog/dmarc/can-threat-actors-bypass-dmarc/) ## Related Articles [ DMARC 6m How to become a DMARC expert: a 6-step learning path Sep 24, 2024 ](/blog/dmarc/a-detailed-guide-on-becoming-a-dmarc-expert/)[ DMARC 6m A guide to detecting DMARC problems using the pentesting techniques Oct 3, 2024 ](/blog/dmarc/a-guide-to-detecting-dmarc-problems-using-the-pentesting-techniques/)[ DMARC 6m Avoiding common BIMI pitfalls: What goes wrong and how to fix it Jun 24, 2025 ](/blog/dmarc/avoiding-bimi-pitfalls-common-errors-and-how-to-fix-them/)[ DMARC 3m Can threat actors bypass DMARC? Feb 21, 2025 ](/blog/dmarc/can-threat-actors-bypass-dmarc/) ```json {"@context":"https://schema.org","@type":"Organization","name":"DuoCircle LLC","url":"https://www.duocircle.com","logo":{"@type":"ImageObject","url":"https://www.duocircle.com/images/duocircle-logo.png"},"description":"DuoCircle is a portfolio of specialized email products covering protection, authentication, delivery, and routing. We deliver about 90% of category-leader capability at roughly half the price, backed by experts who own the outcome. Trusted by 50,000+ organizations since 2014.","subOrganization":[{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138898167","name":"DMARC Report","url":"https://dmarcreport.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897474","name":"AutoSPF","url":"https://autospf.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897912","name":"Phish Protection","url":"https://www.phishprotection.com"}],"sameAs":["https://www.linkedin.com/company/duocircle","https://x.com/duocirclellc","https://www.facebook.com/duocirclellc","https://www.g2.com/products/phish-protection-by-duocircle/reviews","https://github.com/duocircle","https://www.crunchbase.com/organization/duocircle-llc"],"contactPoint":{"@type":"ContactPoint","contactType":"customer support","url":"https://support.duocircle.com"},"knowsAbout":["Email Security","Email Authentication","SPF","DKIM","DMARC","Phishing Protection","Spam Filtering","SMTP Relay","Email Deliverability","Email Forwarding"]} ``` ```json {"@context":"https://schema.org","@type":"WebSite","name":"DuoCircle LLC","url":"https://www.duocircle.com","description":"DuoCircle is a portfolio of specialized email products covering protection, authentication, delivery, and routing. We deliver about 90% of category-leader capability at roughly half the price, backed by experts who own the outcome. Trusted by 50,000+ organizations since 2014.","publisher":{"@type":"Organization","name":"DuoCircle LLC","url":"https://www.duocircle.com","logo":{"@type":"ImageObject","url":"https://www.duocircle.com/images/duocircle-logo.png"},"description":"DuoCircle is a portfolio of specialized email products covering protection, authentication, delivery, and routing. We deliver about 90% of category-leader capability at roughly half the price, backed by experts who own the outcome. Trusted by 50,000+ organizations since 2014.","subOrganization":[{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138898167","name":"DMARC Report","url":"https://dmarcreport.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897474","name":"AutoSPF","url":"https://autospf.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897912","name":"Phish Protection","url":"https://www.phishprotection.com"}]}} ``` ```json [{"@context":"https://schema.org","@type":"BlogPosting","headline":"How does DKIM alignment affect overall DMARC compliance?","description":"How does DKIM alignment affect overall DMARC compliance?","url":"https://www.duocircle.com/blog/dmarc/how-does-dkim-alignment-affect-overall-dmarc-compliance/","datePublished":"2025-02-05T20:29:32.000Z","dateModified":"2025-04-09T13:25:18.000Z","dateCreated":"2025-02-05T20:29:32.000Z","author":{"@type":"Person","@id":"https://www.duocircle.com/authors/brad-slavin/#person","name":"Brad Slavin","url":"https://www.duocircle.com/authors/brad-slavin/","jobTitle":"General Manager","description":"Brad Slavin runs DuoCircle, the company behind DMARC Report, AutoSPF, Phish Protection, and Mailhop. His focus is product strategy, customer relationships, and the commercial and compliance side of email authentication (DPAs, SLAs, enterprise procurement).","image":"https://media.mailhop.org/dmarcreport/images/team/brad-slavin.jpg","knowsAbout":["Email Security Strategy","SaaS Product Management","Enterprise Compliance","Customer Success","Email Deliverability Business"],"worksFor":{"@type":"Organization","name":"DuoCircle LLC","url":"https://www.duocircle.com"},"sameAs":["https://www.linkedin.com/in/bradslavin"]},"publisher":{"@type":"Organization","name":"DuoCircle LLC","url":"https://www.duocircle.com","logo":{"@type":"ImageObject","url":"https://www.duocircle.com/images/duocircle-logo.png"},"description":"DuoCircle is a portfolio of specialized email products covering protection, authentication, delivery, and routing. We deliver about 90% of category-leader capability at roughly half the price, backed by experts who own the outcome. Trusted by 50,000+ organizations since 2014.","subOrganization":[{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138898167","name":"DMARC Report","url":"https://dmarcreport.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897474","name":"AutoSPF","url":"https://autospf.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897912","name":"Phish Protection","url":"https://www.phishprotection.com"}]},"mainEntityOfPage":{"@type":"WebPage","@id":"https://www.duocircle.com/blog/dmarc/how-does-dkim-alignment-affect-overall-dmarc-compliance/"},"articleSection":"dmarc","keywords":"DKIM, DMARC, spf","wordCount":494,"image":{"@type":"ImageObject","url":"https://media.mailhop.org/duocircle/images/2025/02/spf-record-checker-5432.jpg","caption":"DKIM alignment","width":900,"height":600},"speakable":{"@type":"SpeakableSpecification","cssSelector":[".answer-block","h1"]}},{"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Blog","item":"https://www.duocircle.com/blog/"},{"@type":"ListItem","position":2,"name":"DMARC"},{"@type":"ListItem","position":3,"name":"How does DKIM alignment affect overall DMARC compliance?","item":"https://www.duocircle.com/blog/dmarc/how-does-dkim-alignment-affect-overall-dmarc-compliance/"}]}] ``` ```json {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://www.duocircle.com/"},{"@type":"ListItem","position":2,"name":"Blog","item":"https://www.duocircle.com/blog/"},{"@type":"ListItem","position":3,"name":"DMARC","item":"https://www.duocircle.comundefined"},{"@type":"ListItem","position":4,"name":"How does DKIM alignment affect overall DMARC compliance?","item":"https://www.duocircle.com/blog/dmarc/how-does-dkim-alignment-affect-overall-dmarc-compliance/"}]} ``` ```json {"@context":"https://schema.org","@type":"BlogPosting","headline":"How does DKIM alignment affect overall DMARC compliance?","description":"How does DKIM alignment affect overall DMARC compliance?","url":"https://www.duocircle.com/blog/dmarc/how-does-dkim-alignment-affect-overall-dmarc-compliance/","datePublished":"2025-02-05T20:29:32.000Z","dateModified":"2025-04-09T13:25:18.000Z","dateCreated":"2025-02-05T20:29:32.000Z","author":{"@type":"Person","@id":"https://www.duocircle.com/authors/brad-slavin/#person","name":"Brad Slavin","url":"https://www.duocircle.com/authors/brad-slavin/","jobTitle":"General Manager","description":"Brad Slavin runs DuoCircle, the company behind DMARC Report, AutoSPF, Phish Protection, and Mailhop. His focus is product strategy, customer relationships, and the commercial and compliance side of email authentication (DPAs, SLAs, enterprise procurement).","image":"https://media.mailhop.org/dmarcreport/images/team/brad-slavin.jpg","knowsAbout":["Email Security Strategy","SaaS Product Management","Enterprise Compliance","Customer Success","Email Deliverability Business"],"worksFor":{"@type":"Organization","name":"DuoCircle LLC","url":"https://www.duocircle.com"},"sameAs":["https://www.linkedin.com/in/bradslavin"]},"publisher":{"@type":"Organization","name":"DuoCircle LLC","url":"https://www.duocircle.com","logo":{"@type":"ImageObject","url":"https://www.duocircle.com/images/duocircle-logo.png"},"description":"DuoCircle is a portfolio of specialized email products covering protection, authentication, delivery, and routing. We deliver about 90% of category-leader capability at roughly half the price, backed by experts who own the outcome. Trusted by 50,000+ organizations since 2014.","subOrganization":[{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138898167","name":"DMARC Report","url":"https://dmarcreport.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897474","name":"AutoSPF","url":"https://autospf.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897912","name":"Phish Protection","url":"https://www.phishprotection.com"}]},"mainEntityOfPage":{"@type":"WebPage","@id":"https://www.duocircle.com/blog/dmarc/how-does-dkim-alignment-affect-overall-dmarc-compliance/"},"articleSection":"dmarc","keywords":"DKIM, DMARC, spf","wordCount":494,"image":{"@type":"ImageObject","url":"https://media.mailhop.org/duocircle/images/2025/02/spf-record-checker-5432.jpg","caption":"DKIM alignment","width":900,"height":600},"speakable":{"@type":"SpeakableSpecification","cssSelector":[".answer-block","h1"]}} ```