Glossary · Authentication
DMARC alignment means the domain that passed SPF or DKIM matches the domain in the visible From address, which is what DMARC actually requires.
SPF authenticates the envelope sender (Return-Path) domain; DKIM authenticates the signing domain (d=). Neither has to match the From address on its own. DMARC passes only when at least one of them passes and matches the From domain.
Relaxed alignment, the default, accepts a shared organisational domain, so mail.acme.com aligns with acme.com. Strict alignment (adkim=s, aspf=s) needs an exact match. The common failure is a third-party service that signs with its own domain: DKIM passes, but not for your domain, so DMARC fails until you set up custom DKIM with them.
Every domain you run in one inbox, from $3 a mailbox. 14 days free, no card.