Deliverability
SPF/DKIM/DMARC alignment checker
Paste a message’s headers and see whether its DKIM signature and Return-Path actually align with the From: address the reader sees - strict and relaxed.
Free, no accountIn your browser
Paste the whole block. Nothing you paste here leaves your browser.
Result
Paste a header block to check SPF, DKIM and DMARC alignment
Alignment is read from the From:, Return-Path and DKIM-Signature headers once there is a block to read.
What this is
This DMARC alignment checker reads a pasted header block - the visible From: address, the DKIM signature’s d=, and the Return-Path - and shows whether each aligns with the From: domain under strict or relaxed mode, the same two modes a DMARC record’s own adkim and aspf tags set (see the DMARC checker’s explanation of adkim and aspf). It is reading claimed alignment for one message in hand, not re-verifying a signature or looking up a domain’s policy.
A DMARC pass needs SPF or DKIM to not just succeed, but to succeed for a domain that "aligns" with the one the reader sees in From:. Strict alignment demands the two domains match exactly; relaxed alignment only asks that they share the same organisational domain - a subdomain of the other is close enough.
This tool answers that question for one message already in hand, reading the domains straight out of its headers, rather than for a domain’s published policy in the abstract - which is what the dedicated DMARC checker and DKIM checker do instead.
How to read the result
The From: address’s domain is the anchor every other comparison is made against. The DKIM signature’s d= is compared to it twice - once for an exact match (strict) and once for a shared organisational domain (relaxed) - and the Return-Path domain is compared the same way for what SPF would have checked.
A check can pass strict, fail strict but pass relaxed, or fail both. Each of the three has its own finding, named for which mode it is about, so a message that only aligns loosely is not reported the same way as one that does not align at all.
Common mistakes
What goes wrong most often, and how to tell.
- Reading a DKIM pass as proof the From: address is genuineA DKIM signature only ever proves which domain signed the message - not that the signing domain matches what the reader sees in From:. A forwarder or a sending platform that signs with its own domain produces a valid signature that still fails alignment against the sender the reader sees.
- Treating relaxed alignment as "basically the same" as strictRelaxed mode is a deliberate policy choice, not a rounding error: it lets a subdomain stand in for its parent, which is useful for a sender that signs from mail.example.com while sending From: example.com, but it also lets through anything else sharing that organisational domain.
- Assuming this re-verifies the DKIM signature itselfIt does not. The signing key is not fetched and nothing here re-hashes the message - this reads what the header block claims, which can differ from what actually verified at delivery time if the key has since rotated.
Questions
What people ask about this tool.
- Strict alignment requires the DKIM signature’s domain, or the SPF envelope sender’s domain, to exactly match the domain in the visible From: address. Relaxed alignment only requires the two to share the same organisational domain, so mail.example.com aligns with example.com under relaxed mode but not under strict.
- Because a DKIM pass only proves the signature verified for whichever domain actually signed the message - it says nothing about whether that domain matches the one the reader sees in From:. A forwarder or a marketing platform signing with its own domain is the usual cause.
- No. It reads the domains the header block claims - the From: address, the DKIM signature’s d=, and the Return-Path - and compares them. The signing key is not fetched, so this cannot tell you whether the signature itself still verifies, only whether the domains it names would align if it did.
- From the message’s raw source rather than the reading pane: in Gmail, the message menu then "Show original"; in Outlook, "View" then "Message details"; in Apple Mail, View then Message then All Headers.
Use it from the API
The same check, as one request.