InboxRatio
Check your domain

Glossary term

DKIM alignment: whose signature is on your mail?

What DKIM alignment is

DKIM alignment is the DMARC rule that a valid DKIM signature only counts if the signing domain matches the domain in the message's From: header. The signing domain is whatever appears in the signature's d= tag — and under RFC 7489, which defines DMARC and its alignment concept, a signature from the wrong d= is a signature for someone else.

The subtlety exists because DKIM itself, per RFC 6376, is domain-agnostic by design. Any domain can sign any message; the signature proves the message passed through the signer's hands unmodified, nothing more. A message can carry a perfectly valid signature with d=espmail.com while displaying From: hello@yourbrand.com:

DKIM-Signature: v=1; a=rsa-sha256; d=espmail.com; s=selector1; ...
From: hello@yourbrand.com

Verifiers confirm that signature happily. DMARC then asks its one additional question — does espmail.com match yourbrand.com? — and the answer determines whether this signature helps you or merely exists. Here, it merely exists.

Alignment, in short, converts "someone vouched for this message" into "the visible sender vouched for this message." DMARC accepts nothing less.

How DKIM alignment differs from a valid signature

Validity and alignment are independent axes, which gives four combinations worth keeping straight:

  • Valid and aligned — signature verifies, d= matches the From domain. This is the state that passes DMARC and the target of all configuration work.
  • Valid, unaligned — signature verifies for a third-party domain. The default state of un-configured ESP sending. Contributes nothing to your DMARC evaluation.
  • Invalid, would-be-aligned — your domain's signature, broken in transit or misconfigured (wrong key in DNS, content modified after signing). Fails outright.
  • No signature — nothing to evaluate; DMARC falls back to hoping SPF alignment holds.

The comparison mode adds one refinement. DMARC's adkim tag selects relaxed alignment (r, the default), where d=mail.yourbrand.com aligns with a From of yourbrand.com through their shared organizational domain, or strict (s), demanding an exact match. Relaxed accommodates the near-universal pattern of signing from a dedicated subdomain; strict breaks it, and is chosen deliberately or regretted promptly.

The neighboring term "DMARC alignment" covers this plus its SPF twin: DMARC passes when either mechanism produces a valid, aligned result. One suffices; two is the resilient configuration.

How DKIM alignment works

Alignment is achieved in setup, not at send time — the work is getting your platform to sign as you:

  1. The platform generates a keypair and gives you DNS records — usually CNAMEs like s1._domainkey.yourbrand.com pointing into their infrastructure, sometimes a raw TXT record with the public key.
  2. You publish them, the platform verifies, and its signer switches from its shared default domain to d=yourbrand.com (or a subdomain of it) with rotating selectors managed on their side.
  3. Every message now carries a signature whose d= aligns with your From header. Receivers verify it against the key in your DNS, and DMARC counts the result.

Providers name this step differently — custom DKIM, domain authentication, sender verification — but the artifact to check is always the same: the d= value in the headers of a real delivered message. Read the DKIM-Signature and Authentication-Results headers (the email header analyzer will parse them), and confirm the published key with a DKIM checker against your selector.

Why alignment leans on DKIM specifically: signatures travel inside the message, so they survive the forwarding hops that destroy SPF alignment — the forwarder changes the sending IP but usually not the signed content. RFC 7960's catalog of indirect-flow failures is largely a list of situations where aligned DKIM is the mechanism left standing. Mailing lists that rewrite subjects or append footers remain the exception: they break the signature by modifying what it covers.

DKIM alignment and your deliverability

Since Gmail and Yahoo folded DMARC into their bulk sender requirements, alignment stopped being an enforcement-day detail and became table stakes: DMARC passes only on an aligned mechanism, and aligned DKIM is the mechanism that keeps passing after forwarding. A sender with default ESP signing and a default ESP bounce domain passes DMARC never — regardless of how legitimate the mail is.

Beyond compliance, the d= domain is a reputational address. Signing under your own domain routes the credit for wanted mail — and the blame for unwanted mail — to your domain's ledger rather than a signing domain shared with strangers. Gmail's Postmaster Tools reporting is keyed to authenticated traffic for your domain, so unaligned signing also means flying blind in the tooling that would otherwise show you your standing.

The failure symmetry is worth respecting: a broken would-be-aligned signature is worse than none for the affected mail, since DMARC sees your domain claiming authorship it cannot verify. Key rotation hygiene — publishing new keys before retiring old selectors, verifying after DNS changes — is part of alignment, not an optional extra.

Limitations and failure modes

The unconfigured default. The dominant failure by volume: an ESP account created in an afternoon, sending for years under the platform's shared d=. Everything works — until a DMARC policy moves to enforcement or a bulk-sender rule tightens, and mail that "always delivered" starts failing authentication. The DMARC aggregate reports listed the unaligned source the whole time.

The half-finished DNS task. Custom DKIM records generated, two of three CNAMEs published, verification never re-run. The platform silently falls back to shared signing, and the sender believes a task is done that is not. Verification means reading headers on a delivered message, not the platform's settings page.

Signature breakage downstream. Footer-appending gateways, compliance banners, and subject-tagging security appliances modify signed content between signing and delivery, invalidating alignment the sender correctly configured. Diagnosis lives in Authentication-Results at the receiving end: dkim=fail with your d= present means modification-in-transit, not misconfiguration at the platform.

Strict mode collisions. adkim=s published on principle, ESP signing from mail.yourbrand.com, alignment gone. Relaxed is the engineered default; strict is for architectures that exactly match From and d= and know why.

Selector amnesia. Old platforms' selectors left in DNS after offboarding, or keys deleted while mail still signs against them. The _domainkey namespace deserves an inventory: every live selector is an authorized signer for your name, and every dangling one is either dead weight or, if it points into re-assignable vendor infrastructure, a risk.

Fixing DKIM by widening SPF. Alignment problems on the DKIM side cannot be patched from the SPF record, though teams try. The two mechanisms align independently; work the one that is broken.

Related terms

DKIM, DMARC, SPF alignment, SPF record, DKIM selector, domain reputation, sender reputation, BIMI.

Frequently asked questions

My DKIM passes — why does DMARC fail? The signature verifies, but its d= domain is not yours. Check the DKIM-Signature header of a delivered message: if d= shows your ESP's domain, enable the platform's custom-domain signing and publish the DNS records it generates. The pass will then count.

What is the difference between DKIM alignment and DMARC alignment? DKIM alignment is one half of DMARC alignment — the requirement that a valid signature's d= match the From domain. DMARC alignment is the umbrella: pass DMARC via aligned DKIM, aligned SPF, or both. One aligned mechanism is sufficient; both is the configuration that survives edge cases.

Should adkim be relaxed or strict? Relaxed, unless you have engineered an exact-match setup on purpose. It still requires your organizational domain — a stranger's subdomain never aligns — while permitting the subdomain signing pattern platforms use.

Does DKIM alignment survive forwarding? Usually, and this is its structural advantage over SPF alignment: the signature travels with the message and verifies from any delivery path, as long as the forwarder does not modify signed content. Mailing lists that rewrite messages are the notable breaker.

How do I verify my alignment is actually working? Three layers: headers of a real delivered message (d= value and the Authentication-Results DMARC verdict), your published key via a DKIM checker, and DMARC aggregate reports for the fleet-wide view across all your sending sources.

Can multiple domains sign one message? Yes — multiple DKIM signatures are legal and common (platform default plus your custom domain, for instance). DMARC evaluates all of them and passes if any valid signature aligns. Extra unaligned signatures are harmless noise.

Open the raw headers of the last campaign you sent and read the d=. If it is not your domain, the fix is a settings page and a few DNS records away — and the DKIM checker will confirm the moment it is done.

Sources