DMARC alignment

Alignment is the part of DMARC that makes it more than a restatement of SPF and DKIM. It requires that the domain which passed authentication matches the domain in the visible From: header.

Why both can pass and DMARC still fail

SPF authenticates the envelope sender, which the recipient never sees. DKIM authenticates whichever domain signed the message, which may be your email provider's rather than yours. Either can pass while the visible From address belongs to a completely different domain.

DMARC fails unless at least one of them aligns with what the human sees.

Relaxed and strict

Relaxed (aspf=r, adkim=r, and the default) accepts a subdomain: mail.example.com aligns with example.com. This is what makes delegated sending domains work.

Strict (aspf=s, adkim=s) requires an exact match.

Choosing strict without a specific reason breaks every provider you had delegated a subdomain to, and the breakage appears weeks later when somebody raises the policy from none.

Related

We wrote about this at length in What DMARC alignment actually breaks. IT Watch monitors SPF, DKIM and DMARC on every domain and alerts when a policy weakens.

See also: SPF lookup limit.