A provider can authenticate its own sending domain while the visible From address uses your business domain. A green SPF result alone therefore does not answer the handover question. Ask for a redacted received-message record showing which authenticated identity aligns with the visible From domain.
Official basis and deliberately narrow model
RFC 7489’s identifier-alignment sections connect DMARC to a passing, aligned SPF or DKIM identity. Checked 16 October 2026. The example uses strict, exact-domain alignment only; it does not implement relaxed organisational-domain matching, DNS discovery or a full receiver policy engine.
Filled header evidence matrix
Synthetic domains: the From domain is studio.example. SPF’s domain below is the MAIL FROM identity, not the visible From address. DKIM’s domain is the verified signature’s d=. All messages are invented.
On narrow screens, scroll sideways to read the full table.
| Case | SPF result / domain | DKIM result / domain | Strict subset output |
|---|---|---|---|
| A | pass / esp.example | pass / esp.example | No aligned pass |
| B | fail / esp.example | pass / studio.example | Aligned pass via DKIM |
| C | pass / studio.example | fail / studio.example | Aligned pass via SPF |
| D | fail / studio.example | fail / studio.example | No authenticated pass |
| E | unknown | unknown | Insufficient evidence; not a measured fail |
Request the right evidence
- Ask the authorised mail administrator for a redacted header from an existing permitted test or diagnostic message.
- Record the trusted receiver’s authentication results, From domain, MAIL FROM domain and each verified DKIM domain.
- Record the actual alignment mode before applying any comparison. Do not run a strict-only worksheet as a complete relaxed-mode checker.
- Separate the authentication result from the receiver’s disposition and the business’s received-enquiry ledger.
Choose the next action from the result
Case A points to a missing aligned identity despite two unrelated passes. Case B can supply the aligned path through DKIM even though SPF failed. Case D needs authentication diagnosis, not just a different visible display name. With case E, obtain evidence first; adding guessed DNS records cannot fill an unknown.
Acceptance output
Use a redacted sender map linking each authorised website mail stream to its visible domain, authenticated identities, alignment mode and observed receiver result. This resource does not send test enquiries, inspect customer mailboxes or change DNS. Header evidence must come through an authorised, privacy-preserving route.
Limits
An aligned pass does not authenticate message content, establish recipient consent, guarantee inbox placement or prove an enquiry was read. Forwarding, multiple signatures and temporary errors require a mail specialist. SPF record selection is a different task covered in the existing SPF selection resource.
Replay the teaching example
These files run locally without network access. They model only the stated cases, not a live vendor integration. Filled inputs and expected results · Inspectable teaching functions
Save both files in one folder. With Node 22.13 or newer, run:
node decision-check.mjs dmarc-alignment-evidence.json