SPF alignment
SPF alignment links the successfully checked SMTP sender domain to the visible sender domain. The DMARC mode determines the required comparison.
SPF alignment is the domain comparison through which DMARC relates a successful SPF check to the visible sender domain. The relevant identity is the one checked for MAIL FROM, not an arbitrary positive HELO result. The visible domain comes from the From field.
Account for the comparison mode
In strict mode, the compared domains must be identical. In relaxed mode, they must have the same organisational domain as determined by the DMARC rules. A shared logo or a similar company name does not replace this comparison.
In the fictional design, a portal sends message A-657 through a service. SPF confirms the service’s SMTP domain. The team also checks whether that domain aligns with the visible sender domain in the intended mode. The statement “SPF successful” alone does not answer that question.
Assess the sending route as a whole
Missing SPF alignment does not automatically mean that DMARC fails overall: A valid, appropriately aligned DKIM signature can provide the required evidence. For approval, document the domains actually used, the applicable mode and the results together. This is a technical domain check, not delivery or personal identity confirmation.
Sources
Related terms
- Sender Policy FrameworkSPF checks a sending server’s authorisation to use an SMTP domain. The visible sender line and receipt are separate questions.
- DMARCDMARC links a successful SPF or DKIM check to the visible sender domain. Policy and reports help with its technical oversight.
- Return-PathReturn-Path records the SMTP reverse path in a header. It explains the technical route for error reports, not a person’s identity.
- Envelope-FromEnvelope-From identifies the SMTP sender for transport and error feedback. It must be distinguished from the visible sender address.
- DMARC aggregate reportA DMARC aggregate report summarises a reporting mail system’s domain checks over a period. It helps examine sending sources and misconfigurations.
- DMARC policyA DMARC policy describes the requested handling of failed domain checks. It repairs neither sending sources nor their alignment.
Articles on this topic
Cloud & Operations with ASES
Hosting, deployment, maintenance and support