The gap it closes
SPF validates the envelope sender — the return-path, which recipients never see. DKIM validates whatever domain signed the message. Neither is necessarily the From address displayed in the inbox.
So a sender can pass SPF on their own domain, sign with their own DKIM key, and put your domain in the From header. Every check passes. The message is still a forgery. Alignment is the rule that catches it.
How it is evaluated
DMARC passes if either SPF or DKIM passes and aligns. SPF alignment compares the return-path domain to the From domain. DKIM alignment compares the signing domain (the d= value in the signature) to the From domain. One aligned pass is enough.
Relaxed alignment, the default, accepts a subdomain match — mail.yourdomain.com aligns with yourdomain.com. Strict alignment requires exact equality.
The two fixes
When mail fails alignment there are only two remedies, and both mean making your sending tool use your domain rather than its own.
Either set a custom return-path — usually a CNAME on a subdomain like bounce.yourdomain.com pointing at the provider — which brings SPF into alignment. Or publish the provider’s DKIM key on your domain so it signs with d=yourdomain.com, which brings DKIM into alignment. DKIM alignment is the more robust of the two because it survives forwarding.
Check yours
These run free in your browser. Nothing you type reaches a server.
Common questions
Do I need both SPF and DKIM aligned?
No. One aligned pass is enough for DMARC. Having both is better, because SPF alignment breaks on forwarding and DKIM alignment usually does not.
Should I use strict or relaxed alignment?
Relaxed, in almost every case. Strict rejects subdomain matches, which breaks the common and perfectly legitimate pattern of sending from a subdomain.
My ESP says DKIM is enabled but DMARC still fails.
Then it is signing with its own domain rather than yours. Check the d= value in a real message header — if it is not your domain, you need to publish the provider's key on your DNS so it signs as you.
Related concepts
If this is the thing going wrong
The pages explain it. If you would rather it was simply fixed, that is the work I do.