DIAGNOSTIC PLAYBOOK
Strict DMARC alignment breaks a subdomain sender
Strict alignment requires an exact domain match for the relevant mechanism. A subdomain relationship that works in relaxed mode can fail after a strict policy change.
HealthCheck Email editorial team · · Examples are illustrative
How to investigate
- Compare header From with the SPF envelope domain and every passing DKIM d domain.
- Inspect aspf and adkim and determine which strict setting affects the legitimate stream.
- Choose an intended identity configuration or alignment policy, then test before expanding enforcement.
What this looks like
ILLUSTRATIVE EXAMPLE
Mail From example.com is signed with d=mail.example.com. Relaxed DKIM alignment may work, but strict alignment does not treat the names as identical.
A mistake to avoid
Do not loosen policy merely because a report contains failures. First establish that the affected sender is legitimate and understand the identity mismatch.
Keep the result in context
DMARC connects the visible From domain to a passing, aligned SPF or DKIM identity. A DNS policy is an instruction to receivers, not a delivery receipt. Use message results and aggregate reports together, and identify legitimate services before tightening a policy.
Take the next step
Use the related check to gather evidence, then compare it with the affected message or service. Keep the result and time with your notes so a later change can be distinguished from the original problem.
Sources and further reading
The protocol references below explain the underlying behavior. Your sending or DNS provider supplies the account-specific settings for its service.