Visual RFC.
ALL RFCs / RFC 9989
Read the RFC ↗
RFC 9989 / CURRENT DMARC

Aligned authentication

01

A successful authentication must align with the Author Domain.

Related RFCs and changes

“Updates” changes part of an earlier RFC. “Obsoletes” replaces it. This list shows selected related documents.

DIAGRAM§ 4.4 ↗
RFC 9989 · § 4.4EXAMPLE
3 / 3
Aligned authenticationA successful authentication must align with the Author Domain.Aligned authenticationAuthor Domain: example.orgSPFDKIMunrelated domainexample.orgPass AND alignment on at least one path
03
Apply alignment

A successful unrelated domain cannot authenticate this Author Domain.

Protocol participantThreat or exceptionProtocol controlSimplified drawings · precise section references
WHAT CHANGED
RFC 7489DMARC domain policy

This revision replaces the earlier public-suffix-list approach with a DNS tree walk and incorporates public-suffix-domain policy handling. Aggregate and failure reporting move to companion RFCs.

Read the updated RFC section ↗
KEY POINT

Either an aligned DKIM pass or an aligned SPF pass is sufficient.

  • Either an aligned DKIM pass or an aligned SPF pass is sufficient.
  • Relaxed alignment compares Organizational Domains; strict requires identical domains.
  • Domain comparisons are case-insensitive.
DETAILS

Examples are illustrative. Read the exact policy, reporting, and privacy rules in the linked current specification.

Read the RFC section ↗

Diagrams simplify the RFC. Read the linked sections for complete requirements.

Privacy
All chapters in this RFC
  1. Aligned authentication
  2. DNS tree walk
  3. Policy tags and scope
  4. Receiver handling
  5. Deployment and feedback
RFC 9700 / CHAPTERS

Chapters

For full details, tables, algorithms, and exceptions, read the original RFC.

RFC status and corrections ↗