Deliverability
DMARC aspf Explained: Strict vs Relaxed SPF Alignment
DMARC aspf sets SPF alignment: r (relaxed, the default) accepts any subdomain of your From domain, s (strict) needs an exact match. Worked examples inside.
Published · Updated
TL;DR: aspf is the DMARC tag that decides how closely the domain SPF checked must match your visible From domain. aspf=r (relaxed, the default) accepts any domain under the same registered domain; aspf=s (strict) needs an exact match. Most senders should leave it relaxed.
The DMARC aspf tag is the SPF identifier alignment mode in a DMARC record. It has two valid values defined in RFC 7489, section 6.3: r for relaxed and s for strict, and when the tag is missing receivers apply r. In relaxed mode, SPF is aligned when the Return-Path (envelope MAIL FROM) domain and the From header domain share the same Organizational Domain, so bounce.example.com aligns with example.com. In strict mode only an exact match aligns, so bounce.example.com fails against example.com. SPF alignment matters because DMARC passes only when SPF or DKIM passes and is aligned with the From domain.
What does aspf mean in DMARC?
aspf means "alignment, SPF". It tells receivers which comparison to run between two domains:
- the RFC5321.MailFrom domain, also called Return-Path or envelope sender, which is the domain SPF actually authenticates (the HELO name is used when MAIL FROM is empty)
- the RFC5322.From domain, the address the recipient sees
SPF on its own never looks at the From header. A spammer can pass SPF for their-domain.net while showing From: billing@yourbank.com. Alignment is the DMARC rule that closes that gap, and aspf sets how strict that rule is. Its DKIM twin is adkim, which compares the DKIM d= domain to the From domain using the same r and s values. For the full picture of how the three records fit, see our guide to DKIM, SPF and DMARC together and the short definition of DMARC alignment.
A record with both tags written out looks like this:
_dmarc.example.com. TXT "v=DMARC1; p=quarantine; aspf=r; adkim=r; rua=mailto:dmarc@example.com"
Why Gmail now enforces it
Consider a SaaS app that sends password resets from no-reply@example.com through an email provider. SPF passes, because the provider's IP is listed in the SPF record of the provider's own bounce domain. But Gmail still reports dmarc=fail if DKIM is also unaligned, because the domain SPF passed for is not your domain.
Since February 1, 2024, Google requires senders of more than 5,000 messages a day to Gmail to publish DMARC (p=none is acceptable) and to have the From domain aligned with either the SPF domain or the DKIM domain. Messages that fail authentication can be marked as spam or rejected with a 5.7.26 error. Alignment is no longer an optional extra.
How does aspf=r vs aspf=s work?
The receiver runs two steps:
- Check SPF for the Return-Path domain against the connecting IP. If SPF does not pass, SPF cannot contribute to DMARC regardless of aspf.
- If SPF passed, compare that domain with the From domain using the mode set by aspf.
Relaxed (`aspf=r`): both domains are reduced to their Organizational Domain, the registered domain found with the public suffix list (RFC 7489, section 3.2). mail.example.com, bounce.example.com and example.com all reduce to example.com, so any pairing aligns. example.co.uk and mail.example.co.uk also align, because co.uk is a public suffix.
Strict (`aspf=s`): the fully qualified domain names must be identical. example.com aligns only with example.com.
Worked example with five messages
Here are five real-shaped messages. In every row SPF itself passes; only alignment differs.
| # | From domain | Return-Path domain | aspf=r | aspf=s |
|---|---|---|---|---|
| 1 | example.com | example.com | aligned | aligned |
| 2 | example.com | bounce.example.com | aligned | fails |
| 3 | mail.example.com | mail.example.com | aligned | aligned |
| 4 | app.example.com | example.com | aligned | fails |
| 5 | example.com | amazonses.com subdomain | fails | fails |
Row 2 is the common case. Most email providers put bounces on a subdomain you delegate to them, such as bounce.example.com, so they can process bounces while your SPF stays aligned. Under relaxed alignment that works. Switch to aspf=s and every one of those messages loses SPF alignment, and DMARC then depends entirely on DKIM.
Row 5 shows why aspf mode is not the fix for a provider's default bounce domain. When the Return-Path belongs to a different registered domain, neither mode aligns.
Does SPF alignment fail when sending through an ESP?
Often, yes, unless you set up a custom bounce domain. Many providers use their own domain as the Return-Path by default. Amazon SES, for example, uses a subdomain of amazonses.com as the MAIL FROM domain unless you configure a custom MAIL FROM domain. Its documentation states that SPF alignment requires a custom MAIL FROM domain, and that a strict aspf=s tag must be removed for that subdomain to align.
The usual fix has two parts:
- Configure a custom MAIL FROM (Return-Path) subdomain such as
bounce.example.comat your provider, with the MX and SPF TXT records it gives you. Our explainer on the Return-Path header covers what those records do. - Keep
aspf=r, so that subdomain aligns withexample.com.
Some providers cannot offer a custom Return-Path at all. In that case SPF will never align, and DKIM with your own d= domain carries DMARC on its own, as the EasyDMARC walkthrough below shows.
This section walks through SPF and DKIM alignment with concrete From and Return-Path pairs, then explains why email providers that own the bounce address need a CNAME for aligned return paths, and why DKIM must carry DMARC when SPF cannot align.
aspf vs adkim: what is the difference?
aspf | adkim
| Compares From domain with | Return-Path (MAIL FROM) domain | DKIM signature d= domain |
|---|---|---|
| Default | r | r |
| Survives forwarding | Usually not (the forwarder's IP fails SPF) | Usually yes, if the body is unchanged |
| Typical strict-mode breakage | Provider bounce subdomains | Signing with the parent domain while sending from a subdomain |
Because SPF breaks on forwarding and DKIM usually survives it, DKIM alignment is the more dependable path to a DMARC pass. If you want to confirm your signature first, check for DKIM on your domain.
Should I use strict or relaxed SPF alignment?
Use relaxed unless you have a specific reason not to. Strict SPF alignment adds little protection, because an attacker who can send from a subdomain of yours already controls DNS or a server inside your organization. It does, however, break the standard provider setup in row 2 above.
Strict mode is reasonable when:
- you send only from the exact From domain, with no provider bounce subdomains
- you have DMARC aggregate reports confirming every legitimate source aligns exactly
- different teams own different subdomains and you want each one isolated
Before tightening, run p=none with rua reports for a few weeks, then move through quarantine and reject as explained in our post on DMARC policy p=none, quarantine and reject.
Common pitfalls
- Setting aspf=s "for security" and silently failing SPF alignment for every provider using a bounce subdomain.
- Assuming SPF pass means DMARC pass. Check the
smtp.mailfrom=value in the Authentication-Results header against the From domain. - Expecting aspf to fix a third-party Return-Path. Relaxed mode only helps when both domains share a registered domain.
- Ignoring subdomain policy.
sp=controls policy for subdomains; it does not change alignment.
If you send product email from code or from AI agents, SendHQ sets up a verified domain with DKIM and a custom MAIL FROM, then shows per-message delivery, bounce and complaint events so you can see alignment failures as they happen. Create a SendHQ account and send your first aligned email from the API.
FAQ
What is the default value of aspf in DMARC?
The default is r (relaxed). If your DMARC record has no aspf tag, receivers treat SPF alignment as relaxed, per RFC 7489.
Can DMARC pass if SPF alignment fails?
Yes. DMARC passes when either SPF or DKIM both passes and aligns. With an aligned DKIM signature, an unaligned SPF result does not cause a DMARC failure.
How do I check my aspf setting?
Look up the TXT record at _dmarc.yourdomain.com, for example with dig TXT _dmarc.example.com +short. If no aspf= tag appears, you are using relaxed alignment. Our DMARC check guide walks through reading the result.
Does aspf=s block subdomain spoofing?
Not meaningfully. Spoofing an unrelated domain fails alignment in both modes. Strict mode only rejects your own subdomains, which attackers cannot use without access to your DNS.
What do aspf=r and adkim=r mean together?
Both SPF and DKIM use relaxed alignment, so either check can pass DMARC with any domain under your registered domain. This is the default and the most common setup.