DKIM Alignment: Why "Signing" Isn't Enough

"DKIM" sounds reassuring: your email is digitally signed, so it must authenticate. But DMARC has a stricter requirement than "a signature exists." The signature must be aligned with the domain in the From header. Sign with the wrong domain, or fail to cover the From address, and your mail can carry a valid DKIM signature and still fail DMARC.

This guide explains what DKIM alignment is, why it trips people up, and how to check and fix it.

What DKIM does

DKIM (DomainKeys Identified Mail) lets a domain cryptographically sign the content and headers of an email. A receiving server looks up the signing domain's public key in DNS and verifies the signature, proving the message wasn't tampered with after signing and was sent by someone holding the private key.

A DKIM signature header (DKIM-Signature:) includes:

• d= — the signing domain.
• s= — the selector used to find the public key.
• h= — the signed headers (which headers the signature covers).

What "alignment" means

DMARC doesn't just ask "is there a DKIM signature?" It asks: does the signing domain match the From domain?

The From header is the address a recipient sees as the sender, e.g. From: hello@yourdomain.com. For DMARC's DKIM check to pass:

• The DKIM d= domain must exactly match the From domain (strict alignment), or
• The d= domain must be a subdomain of the From domain (relaxed alignment).

If d= is mailer.thirdparty.com but the From is yourdomain.com, that's a misalignment — the DKIM signature exists but does not satisfy DMARC.

Why your mail can fail even when signed

Two common scenarios:

1. Third-party sender signs with its own domain. You send through an email provider that signs with its own domain (d=provider.com) while your From is yourdomain.com. The message is signed, but not aligned — so DMARC's DKIM check fails.

2. The From header isn't covered by the signature. DKIM signs the headers in h=. If the From header wasn't among them (or was modified after signing), the signature is invalid for DMARC purposes even if it "verifies."

How to check alignment

You can verify DKIM alignment with a lookup plus the message headers:

1. Find the signing domain — look at d= in the DKIM-Signature: header.
2. Compare it to the From domain. They must match or be an aligned subdomain.
3. Check the selector — the public key must exist at s._domainkey.<d=domain>.
4. Verify the signature — your DKIM inspector (/tools/dkim-inspector) checks the selector's key length and flags; a full header check tells you if it verifies and is aligned.

Fixing alignment

1. Sign with the From domain. Configure your email provider to sign with yourdomain.com (most let you set up DKIM for your own domain and sign with it).
2. Or use an aligned subdomain. If you must sign with a subdomain, make it a subdomain of the From domain (e.g. From: user@yourdomain.com, d=mail.yourdomain.com).
3. Ensure the From header is signed. Confirm h= includes from.
4. Check SPF too. DMARC passes if either SPF or DKIM is aligned — so a properly aligned SPF can carry a message even when DKIM isn't aligned. But you should fix both for reliability.

The takeaway

DKIM signing alone isn't enough for DMARC — the signature must be aligned with the From domain. Check that d= matches your From domain (or an aligned subdomain), that the From header is covered by the signature, and that the selector's key is valid. Get alignment right and your DMARC policy will actually authenticate your mail instead of failing it.

Next, read the DMARC migration guide to enforce a policy, and make sure your SPF is healthy too.

What alignment means and why it matters

DKIM alignment is the bridge between "the message is signed" and "the message is genuinely from this domain." A message can carry a valid DKIM signature from a domain that has nothing to do with the visible sender; alignment closes that gap by requiring that the domain used in the DKIM signature matches the domain in the visible From address. For DMARC to consider the mail passing, the authentication must be aligned — a signed message from a different domain does not help the sending domain's reputation. This is why "we use DKIM" is not enough; alignment is what makes DKIM actually protect your domain.

Strict vs relaxed alignment

DMARC defines two alignment modes, and the choice trades security against real-world complexity:

• Relaxed alignment allows the signing domain to be a subdomain of the From domain (for example, a signature signed by mail.example.com aligning to example.com). This is the common default and accommodates third-party sending systems that sign from a related subdomain.
• Strict alignment requires the signing domain to match the From domain exactly. It is more secure but harder to satisfy when you use external senders that sign from their own domain.

Most teams start with relaxed alignment and tighten toward strict only for the highest-value domains once their sending is consolidated. Choosing deliberately — and knowing which mode your senders can actually meet — prevents DMARC from rejecting legitimate mail.

Diagnosing the common alignment failures

Alignment problems usually show up as DMARC failures despite valid signatures, and the causes are patternable:

• A third-party sender signs from its own domain, not yours, so strict alignment fails.
• Multiple From domains with one signature — the signature aligns to one but not the others.
• The DKIM selector or header is inconsistent across systems, breaking signature verification.
• Forwarding alters headers in a way that invalidates the signature or changes alignment.

Reading the aggregate reports tells you which senders are failing alignment and why, so you can fix the specific source rather than weakening the policy.

Fixing alignment without breaking delivery

The fix is usually targeted: for each legitimate sender failing alignment, either configure it to sign from your domain (or an allowed subdomain) or, if strict is causing the breakage, evaluate whether relaxed is acceptable for that sender. Make these corrections while still in p=none or a low pct, confirm the senders now align and pass, and only then tighten. This keeps the migration to a strict policy evidence-based and safe, exactly as the DMARC migration guide describes.