SPF vs DKIM alignment

SPF authenticates the envelope domain. DKIM authenticates the signing domain. DMARC compares those identities with the domain shown in the From header.

A third-party platform may use its own bounce domain. SPF can pass for that domain while failing DMARC alignment with your visible From domain.

An aligned DKIM signature can remain valid through forwarding when signed content is not changed. Mailing lists that modify messages may break the signature.

Relaxed alignment allows organizational-domain alignment; strict alignment requires exact domain matches. Strict is not automatically better for every legitimate sending architecture.