--- title: "What is DKIM Alignment and How Does it Impact DMARC? | DuoCircle" description: "What is DKIM Alignment and How Does it Impact DMARC?" image: "https://www.duocircle.com/images/og-default.png" canonical: "https://www.duocircle.com/blog/email-security/what-is-dkim-alignment-how-does-it-impact-dmarc/" --- Quick Answer DKIM alignment is the check that the d= domain in the DKIM signature matches the domain in the From header. It is separate from DKIM authentication, which only verifies the signature itself. DMARC requires alignment: a message can pass DKIM authentication and still fail DMARC if the signing domain does not align with From. Two modes: relaxed (adkim=r, default), where the d= domain can match the From domain or be a subdomain (mail.example.com signing for example.com passes); strict (adkim=s), where the d= domain must match the From domain exactly. Choose strict when you fully control all signing infrastructure; choose relaxed when third-party senders sign with their own subdomains under your apex. What is DKIM Alignment and How Does it Impact DMARC? Your browser does not support the audio element. [ Download episode](https://media.mailhop.org/duocircle/images/2024/05/What-is-DKIM-Alignment-and-How-Does-it-Impact-DMARC.mp3) Share [ ](https://www.linkedin.com/sharing/share-offsite/?url=undefined%2Fblog%2Femail-security%2Fwhat-is-dkim-alignment-how-does-it-impact-dmarc%2F "Share on LinkedIn") [ ](https://twitter.com/intent/tweet?text=What%20is%20DKIM%20Alignment%20and%20How%20Does%20it%20Impact%20DMARC%3F&url=undefined%2Fblog%2Femail-security%2Fwhat-is-dkim-alignment-how-does-it-impact-dmarc%2F "Share on X/Twitter") [ ](https://www.facebook.com/sharer/sharer.php?u=undefined%2Fblog%2Femail-security%2Fwhat-is-dkim-alignment-how-does-it-impact-dmarc%2F "Share on Facebook") [ ](https://reddit.com/submit?url=undefined%2Fblog%2Femail-security%2Fwhat-is-dkim-alignment-how-does-it-impact-dmarc%2F&title=What%20is%20DKIM%20Alignment%20and%20How%20Does%20it%20Impact%20DMARC%3F "Share on Reddit") [ ](mailto:?subject=What%20is%20DKIM%20Alignment%20and%20How%20Does%20it%20Impact%20DMARC%3F&body=Check out this article: undefined%2Fblog%2Femail-security%2Fwhat-is-dkim-alignment-how-does-it-impact-dmarc%2F "Share via Email") ![DuoCircle blog post image](https://media.mailhop.org/duocircle/images/2024/05/spf-record-generator-8001.jpg) If you are an [email marketer](/dmarc/how-does-dmarc-help-marketers-improving-email-deliverability/) or brand that sends out regular email campaigns, you would agree with us when we say that **building trust with your audience** is the key to converting them into your customers. But how do you build that trust, especially through email campaigns? _One way is to craft email content in a way that **recognizes their needs** and delivers what they want to hear_. Apart from this, there’s another way to reinforce your brand’s integrity and legitimacy among your clients, signing your emails with [DKIM](/resources/what-is-dkim). This is a **simple yet significant way** to ensure that your email content has not been altered in transit, which also helps establish trust with your recipients. There’s more to DKIM than simply signing your emails with a [digital signature](https://www.ibm.com/docs/en/b2badv-communication/1.0.0?topic=overview-digital-signature); it also plays a crucial role in DMARC compliance by verifying that the parent domain of the email that is used to create the [DKIM signature](https://serverfault.com/questions/591655/what-domain-name-should-appear-in-a-dkim-signature) matches the “From” domain in the header. This is what we call DKIM alignment. Let’s **dive deep** into what it means and how it can impact your overall [email hygiene](https://www.forbes.com/sites/forbestechcouncil/2023/06/21/an-executive-guide-to-email-hygiene-secure-communication-and-boost-business-value/). ## What is DKIM Alignment? Before you fall into the trap, we would like to clear things out, **DKIM authentication and alignment are not the same!** While most people use them interchangeably, they are two ways to evaluate DKIM and are vastly different from each other. DKIM authentication simply involves adding a digital signature generated with a private key to the email header, which is then verified by the recipient’s server with the [public key](https://www.techtarget.com/searchsecurity/definition/public-key) that is published in the sender’s DNS. When it comes to [DKIM alignment](https://certified-senders.org/blog/dkim-alignment-matching-of-header-domains/), things go a step further than this. _This step ensures that the domain in the DKIM signature (the d= domain) matches the domain in the “From” header of the email._ **This alignment is crucial** because it adds an additional layer of trust, confirming that the email is not only uncompromised but also comes from the trusted domain. [![DKIM authentication](https://media.mailhop.org/duocircle/images/2024/05/spf-permerror-6001.jpg)](https://media.mailhop.org/duocircle/images/2024/05/spf-permerror-6001.jpg) ## What are the Two Types of DKIM Alignments? If there’s one claim that we can make with utmost surety, it’s that each organization has its own unique needs and goals for its [email campaigns](/email-services/5-common-email-marketing-challenges-and-how-to-overcome-them/), and following a singular approach will simply not suffice. To cater to these **ever-evolving needs**, DKIM offers two alignment modes: strict and relaxed. Here’s a breakdown of what these **alignment modes** entail and what they mean for your [email authentication](/resources/email-authentication) strategy. ### Relaxed DKIM Alignment (adkim=r) This alignment mode **offers some flexibility** when it comes to matching the d= domain and the “From” domain. In this mode, it isn’t necessary for the two fields to exactly match each other. _Instead, the d= domain can either match the “From” domain exactly or be a subdomain of the “From” domain._ For instance, DKIM alignment will pass in the following cases: - d=example.com & From: example.com - d=email.example.com & From: example.com However, if d=example.email.com & From: example.com are there, then DKIM alignment will fail. ### Strict DKIM Alignment (adkim=s) When it comes to strict DKIM alignment, the approach followed is more stringent. That is to say, for DKIM to align in the strict mode, the d= domain and the **“From” domain should exactly match**. This is done to ensure that no one tries to [misuse your domain](https://cybersecuritynews.com/subdomailing-hackers-exploit-brands/) and the authenticity of your emails is maintained. _Since this strict alignment offers no room for discrepancy or variations and offers a **high level of security**, it is ideal for financial institutions, government agencies, etc._ In such cases, DKIM alignment will only pass if: - d=example.com & From: example.com It will fail if: - d=email.example.com & From: example.com ## What Does it Mean for DMARC? It is no surprise that [DMARC](/email/dmarc) is considered the **ultimate benchmark** for email authentication and security, but without [SPF](/content/spf-record-check) and DKIM, this authentication protocol is incomplete. That is to say, **DMARC relies on SPF and DKIM** to validate the authenticity of email messages and to ensure they are not spoofed. So, for your emails to safely and effectively reach your recipient’s inbox, it’s essential to properly configure and align these protocols. Speaking of alignment, if you configure DKIM with relaxed alignment, **all your emails** (sent from the parent domain and subdomains) will pass DMARC checks and make their way into the receiver’s inbox. However, with **strict DKIM alignment**, you can expect stronger DMARC validation and enhanced [protection against spoofing](/resources/check-dmarc-records). [![spoofing protection](https://media.mailhop.org/duocircle/images/2024/05/smtp-service-2.jpg)](https://media.mailhop.org/duocircle/images/2024/05/smtp-service-2.jpg) As we have already established earlier, DKIM alignment is not just about ensuring the domains used in the signature and the header match. It goes beyond cursory verification and extends to improving [email deliverability](/a-guide-on-email-deliverability), enhancing [customer trust](https://www.cmswire.com/customer-experience/customer-trust-the-backbone-of-digital-age/), and mitigating the risk of spoofing. With stakes so high, you cannot afford to be complacent when choosing the appropriate type of DKIM alignment. What you can do is partner up with [DuoCircle](/), your ally in all the things related to email authentication. Our team of **experts will help you** ease out all your DKIM alignment woes and work with you to secure your [organization’s digital assets](https://www.mediavalet.com/blog/what-are-digital-assets). To know how, [book a demo](/get-a-quote) with us today! ## Topics DKIMemail securityUpdates ![Brad Slavin](https://media.mailhop.org/dmarcreport/images/team/brad-slavin.jpg) Brad Slavin General Manager General Manager at DuoCircle. Product strategy and commercial lead across the email security portfolio. ## Secure your email infrastructure Protect, authenticate, and deliver. Contact our team to find the right solution. [Contact Sales](/contact/) [Explore Products](/products/) ## Related Articles [ Email Security 8m Configuring DKIM to sign mail from your Microsoft 365 domain Jun 27, 2024 ](/blog/email-security/configuring-dkim-sign-mail-from-your-microsoft-365-domain/)[ Email Security 6m How to fix “Your DKIM signature is not valid” error Jun 28, 2024 ](/blog/email-security/fixing-your-dkim-signature-is-not-valid-error/)[ Email Security 6m How to find a DKIM selector for your domain? Jul 23, 2024 ](/blog/email-security/how-to-find-a-dkim-selector-for-your-domain/)[ Email Security 3m Learning to perform SPF delegation for enhanced email delivery Jul 24, 2024 ](/blog/email-security/learning-to-perform-spf-delegation-for-enhanced-email-delivery/) ```json {"@context":"https://schema.org","@type":"Organization","name":"DuoCircle LLC","url":"https://www.duocircle.com","logo":{"@type":"ImageObject","url":"https://www.duocircle.com/images/duocircle-logo.png"},"description":"DuoCircle is a portfolio of specialized email products covering protection, authentication, delivery, and routing. We deliver about 90% of category-leader capability at roughly half the price, backed by experts who own the outcome. Trusted by 50,000+ organizations since 2014.","subOrganization":[{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138898167","name":"DMARC Report","url":"https://dmarcreport.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897474","name":"AutoSPF","url":"https://autospf.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897912","name":"Phish Protection","url":"https://www.phishprotection.com"}],"sameAs":["https://www.linkedin.com/company/duocircle","https://x.com/duocirclellc","https://www.facebook.com/duocirclellc","https://www.g2.com/products/phish-protection-by-duocircle/reviews","https://github.com/duocircle","https://www.crunchbase.com/organization/duocircle-llc"],"contactPoint":{"@type":"ContactPoint","contactType":"customer support","url":"https://support.duocircle.com"},"knowsAbout":["Email Security","Email Authentication","SPF","DKIM","DMARC","Phishing Protection","Spam Filtering","SMTP Relay","Email Deliverability","Email Forwarding"]} ``` ```json {"@context":"https://schema.org","@type":"WebSite","name":"DuoCircle LLC","url":"https://www.duocircle.com","description":"DuoCircle is a portfolio of specialized email products covering protection, authentication, delivery, and routing. We deliver about 90% of category-leader capability at roughly half the price, backed by experts who own the outcome. Trusted by 50,000+ organizations since 2014.","publisher":{"@type":"Organization","name":"DuoCircle LLC","url":"https://www.duocircle.com","logo":{"@type":"ImageObject","url":"https://www.duocircle.com/images/duocircle-logo.png"},"description":"DuoCircle is a portfolio of specialized email products covering protection, authentication, delivery, and routing. We deliver about 90% of category-leader capability at roughly half the price, backed by experts who own the outcome. Trusted by 50,000+ organizations since 2014.","subOrganization":[{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138898167","name":"DMARC Report","url":"https://dmarcreport.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897474","name":"AutoSPF","url":"https://autospf.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897912","name":"Phish Protection","url":"https://www.phishprotection.com"}]}} ``` ```json [{"@context":"https://schema.org","@type":"BlogPosting","headline":"What is DKIM Alignment and How Does it Impact DMARC?","description":"What is DKIM Alignment and How Does it Impact DMARC?","url":"https://www.duocircle.com/blog/email-security/what-is-dkim-alignment-how-does-it-impact-dmarc/","datePublished":"2024-05-31T17:52:24.000Z","dateModified":"2025-04-25T12:40:00.000Z","dateCreated":"2024-05-31T17:52:24.000Z","author":{"@type":"Person","@id":"https://www.duocircle.com/authors/brad-slavin/#person","name":"Brad Slavin","url":"https://www.duocircle.com/authors/brad-slavin/","jobTitle":"General Manager","description":"Brad Slavin runs DuoCircle, the company behind DMARC Report, AutoSPF, Phish Protection, and Mailhop. His focus is product strategy, customer relationships, and the commercial and compliance side of email authentication (DPAs, SLAs, enterprise procurement).","image":"https://media.mailhop.org/dmarcreport/images/team/brad-slavin.jpg","knowsAbout":["Email Security Strategy","SaaS Product Management","Enterprise Compliance","Customer Success","Email Deliverability Business"],"worksFor":{"@type":"Organization","name":"DuoCircle LLC","url":"https://www.duocircle.com"},"sameAs":["https://www.linkedin.com/in/bradslavin"]},"publisher":{"@type":"Organization","name":"DuoCircle LLC","url":"https://www.duocircle.com","logo":{"@type":"ImageObject","url":"https://www.duocircle.com/images/duocircle-logo.png"},"description":"DuoCircle is a portfolio of specialized email products covering protection, authentication, delivery, and routing. We deliver about 90% of category-leader capability at roughly half the price, backed by experts who own the outcome. Trusted by 50,000+ organizations since 2014.","subOrganization":[{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138898167","name":"DMARC Report","url":"https://dmarcreport.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897474","name":"AutoSPF","url":"https://autospf.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897912","name":"Phish Protection","url":"https://www.phishprotection.com"}]},"mainEntityOfPage":{"@type":"WebPage","@id":"https://www.duocircle.com/blog/email-security/what-is-dkim-alignment-how-does-it-impact-dmarc/"},"articleSection":"email-security","keywords":"DKIM, email security, Updates","wordCount":851,"image":{"@type":"ImageObject","url":"https://media.mailhop.org/duocircle/images/2024/05/spf-record-generator-8001.jpg","caption":"DuoCircle blog post image","width":900,"height":600},"speakable":{"@type":"SpeakableSpecification","cssSelector":[".answer-block","h1"]}},{"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Blog","item":"https://www.duocircle.com/blog/"},{"@type":"ListItem","position":2,"name":"Email Security"},{"@type":"ListItem","position":3,"name":"What is DKIM Alignment and How Does it Impact DMARC?","item":"https://www.duocircle.com/blog/email-security/what-is-dkim-alignment-how-does-it-impact-dmarc/"}]}] ``` ```json {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://www.duocircle.com/"},{"@type":"ListItem","position":2,"name":"Blog","item":"https://www.duocircle.com/blog/"},{"@type":"ListItem","position":3,"name":"Email Security","item":"https://www.duocircle.comundefined"},{"@type":"ListItem","position":4,"name":"What is DKIM Alignment and How Does it Impact DMARC?","item":"https://www.duocircle.com/blog/email-security/what-is-dkim-alignment-how-does-it-impact-dmarc/"}]} ``` ```json {"@context":"https://schema.org","@type":"BlogPosting","headline":"What is DKIM Alignment and How Does it Impact DMARC?","description":"What is DKIM Alignment and How Does it Impact DMARC?","url":"https://www.duocircle.com/blog/email-security/what-is-dkim-alignment-how-does-it-impact-dmarc/","datePublished":"2024-05-31T17:52:24.000Z","dateModified":"2025-04-25T12:40:00.000Z","dateCreated":"2024-05-31T17:52:24.000Z","author":{"@type":"Person","@id":"https://www.duocircle.com/authors/brad-slavin/#person","name":"Brad Slavin","url":"https://www.duocircle.com/authors/brad-slavin/","jobTitle":"General Manager","description":"Brad Slavin runs DuoCircle, the company behind DMARC Report, AutoSPF, Phish Protection, and Mailhop. His focus is product strategy, customer relationships, and the commercial and compliance side of email authentication (DPAs, SLAs, enterprise procurement).","image":"https://media.mailhop.org/dmarcreport/images/team/brad-slavin.jpg","knowsAbout":["Email Security Strategy","SaaS Product Management","Enterprise Compliance","Customer Success","Email Deliverability Business"],"worksFor":{"@type":"Organization","name":"DuoCircle LLC","url":"https://www.duocircle.com"},"sameAs":["https://www.linkedin.com/in/bradslavin"]},"publisher":{"@type":"Organization","name":"DuoCircle LLC","url":"https://www.duocircle.com","logo":{"@type":"ImageObject","url":"https://www.duocircle.com/images/duocircle-logo.png"},"description":"DuoCircle is a portfolio of specialized email products covering protection, authentication, delivery, and routing. We deliver about 90% of category-leader capability at roughly half the price, backed by experts who own the outcome. Trusted by 50,000+ organizations since 2014.","subOrganization":[{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138898167","name":"DMARC Report","url":"https://dmarcreport.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897474","name":"AutoSPF","url":"https://autospf.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897912","name":"Phish Protection","url":"https://www.phishprotection.com"}]},"mainEntityOfPage":{"@type":"WebPage","@id":"https://www.duocircle.com/blog/email-security/what-is-dkim-alignment-how-does-it-impact-dmarc/"},"articleSection":"email-security","keywords":"DKIM, email security, Updates","wordCount":851,"image":{"@type":"ImageObject","url":"https://media.mailhop.org/duocircle/images/2024/05/spf-record-generator-8001.jpg","caption":"DuoCircle blog post image","width":900,"height":600},"speakable":{"@type":"SpeakableSpecification","cssSelector":[".answer-block","h1"]}} ```