DKIM alignment is the part of DMARC that checks whether a passing DKIM signature represents the same domain recipients see in the From address. It is easy to confuse a DKIM pass with a DMARC pass, but the two are not identical. A message can have a valid signature and still fail DMARC if that signature belongs to an unrelated domain.
The three identities to compare
Start with the visible From address, such as updates@example.com. Then find the DKIM d= domain in the message headers. Finally, read the DMARC result in the Authentication-Results line. Alignment asks whether the From domain and the signing domain have the relationship your DMARC policy permits. A valid signature proves the signed content was not changed after signing; alignment connects that signature to the identity recipients see.
Exact and relaxed alignment
Exact alignment requires the DKIM signing domain to match the visible From domain exactly. Relaxed alignment can allow an organizational-domain relationship, such as a controlled subdomain. The effective rule is set by the adkim tag in your DMARC record; if it is absent, relaxed alignment is the default. Decide deliberately before switching to strict alignment, especially if established senders use subdomains.
Find the evidence in a real message
Open a recent message’s full headers and look for DKIM-Signature, Authentication-Results, and the visible From address. The signing domain appears after d=. Compare it with the domain after the @ symbol in From. Our header-reading guide shows where these fields are normally displayed.
Why a DKIM pass can still fail DMARC
A provider may sign every message with its own infrastructure domain. That is technically useful, but a signature from an unrelated provider domain does not give DMARC aligned DKIM for your brand. DMARC can still pass through aligned SPF, yet that may not be reliable for every sender. Treat each authentication result as a separate fact before concluding the message is protected.
Configure third-party platforms carefully
Marketing, CRM, support, invoicing, and transactional platforms usually offer a domain-authentication workflow. Complete it for the exact domain or subdomain used in the visible From address, publish the provider’s DKIM records, and send a fresh test. Do not copy a selector or DNS record from another account unless the provider explicitly instructs it. This DKIM troubleshooting guide covers common failures after setup.
Selectors are not the alignment domain
The selector identifies which public key a receiver should query, for example selector1._domainkey.example.com. The selector itself is not the domain DMARC aligns. Focus on the d= value in the signed message, then confirm the relevant selector record exists and is current. Read the DKIM selector explainer if that distinction is new to your team.
A safe testing workflow
Send a message from every active platform to a mailbox where you can inspect headers. Record the From domain, DKIM d= value, DKIM result, SPF result, and DMARC result. Make one provider configuration or DNS change at a time, wait for the intended change to propagate, then repeat the test. This avoids attributing a result to the wrong change.
When alignment needs attention
Investigate when DMARC fails, the signing domain is unexpected, a vendor cannot sign with your domain, or a sender changed during a migration. Ask the vendor whether it supports custom DKIM signing before weakening a policy. Do not remove a legitimate existing record to make room for an untested one. The DMARC implementation checklist provides the broader rollout sequence.
Keep an ownership record
Maintain a short register for every sender: platform owner, visible From domain, DKIM signing domain, selector, DNS location, and date of the last header test. Review it during vendor changes and before moving from DMARC monitoring to enforcement. Run Beacon’s free domain check to confirm the public SPF, DKIM, and DMARC records behind the message-level evidence.