Alignment, and why it matters

A domain can have valid SPF, valid DKIM, and still fail DMARC. The word that explains it is alignment.

Every message has two senders

An email message has two origin addresses, and they are not the same one.

• The From:, which is what a person sees in their mailbox.
• The envelope, also called Return-Path or MAIL FROM, which is where a bounce goes back to when delivery fails. Nobody sees it.

SPF authenticates the envelope. DKIM signs the body and some headers, and the domain of the signature is the d= inside it.

What DMARC demands

DMARC asks one simple thing: is the domain that was authenticated the same one that appears in the From:?

• SPF alignment: the envelope's domain matches the From:.
• DKIM alignment: the signature's d= matches the From:.

Either one aligning is enough for the message to pass DMARC.

Where this affects you

On C-Connect, DKIM always aligns: we sign with a key published in your domain, and the d= is your domain. So DMARC passes without you doing anything more.

SPF is the one that does not align by default. The envelope is {identifier}@bounce.c-connect.pt, which is ours, so SPF authenticates our domain rather than yours.

From:         receipts@mail.mycompany.com
Return-Path:  01JB2X...@bounce.c-connect.pt     ← authenticates c-connect.pt
DKIM d=       mail.mycompany.com              ← aligns

With the bounce CNAME published:

From:         receipts@mail.mycompany.com
Return-Path:  01JB2X...@bounces.mail.mycompany.com   ← aligns too
DKIM d=       mail.mycompany.com

Is it worth publishing?

Yes, for two reasons.

The first is that some filters give more weight to a message with both aligned than with one. They do not refuse the other, but it counts.

The second is forwarding. When somebody has mail hopping from one mailbox to another, SPF nearly always breaks along the way, because the forwarding server is not in your SPF. At that point DKIM is the only thing holding DMARC up, and a message whose DKIM is also failing for any reason has no net left.

How to publish it

It is a CNAME.

Name:  bounces.mail.mycompany.com
Type:  CNAME
Value: bounce.c-connect.pt

Once it resolves, the panel marks the record as verified and the envelope starts using it on the next message. Nothing in your code has to change.

Reading this in the reports

The Who sends as this domain card shows, per source, how many messages aligned. A source at 100% aligned is you. One at 0% is usually a forwarder, an old provider, or somebody using your name. All three are worth a look, and only the third is a reason to worry.