Identifier Alignment (SPF/DKIM vs DMARC)

The solution for forwarded messages. When an email is forwarded (like by a mailing list), it often breaks SPF and DKIM. ARC is a newer standard that "preserves" the original, valid authentication results for the final receiver to see. It acts like a "notary" that re-seals the cargo at each hop.

15 questions in this topic

What is identifier alignment in DMARC? What is SPF alignment (strict vs. relaxed)? What domain is checked for SPF alignment? (Return-Path vs From) What is DKIM alignment (strict vs. relaxed)? What domain is checked for DKIM alignment? (d= domain vs From) Why does alignment sometimes fail even if SPF/DKIM passes? How do third-party senders affect alignment? How can I fix alignment issues? How do SPF, DKIM, and DMARC work together? What happens if SPF passes but DKIM fails? What is the priority between SPF and DKIM in DMARC alignment? Why do some emails show “Authenticated by XYZ” even with DMARC fail? How do subdomain alignments inherit policy? How does ARC fit into this ecosystem? Why does authentication not equal deliverability?

Questions about Identifier Alignment (SPF/DKIM vs DMARC)