---
title: "DMARC aspf Explained: Strict vs Relaxed SPF Alignment"
description: "DMARC aspf sets SPF alignment: r (relaxed, the default) accepts any subdomain of your From domain, s (strict) needs an exact match. Worked examples inside."
canonical: https://sendhq.cc/blog/dmarc-aspf
last-updated: 2026-11-04
author: Dhrumil Barot
author_bio: Dhrumil is an email marketing expert. Dhrumil built SendHQ so developers and AI agents can send, receive and track email without fighting deliverability on their own.
published: 2026-11-04
updated: 2026-11-04
---
# DMARC aspf Explained: Strict vs Relaxed SPF Alignment

By [Dhrumil Barot](https://sendhq.cc/about.md#founder), Founder

DMARC aspf sets SPF alignment: r (relaxed, the default) accepts any subdomain of your From domain, s (strict) needs an exact match. Worked examples inside.

Published November 4, 2026 · Updated November 4, 2026

**TL;DR:** `aspf` is the DMARC tag that decides how closely the domain SPF checked must match your visible From domain. `aspf=r` (relaxed, the default) accepts any domain under the same registered domain; `aspf=s` (strict) needs an exact match. Most senders should leave it relaxed.

The DMARC aspf tag is the SPF identifier alignment mode in a DMARC record. It has two valid values defined in [RFC 7489, section 6.3](https://www.rfc-editor.org/rfc/rfc7489#section-6.3): `r` for relaxed and `s` for strict, and when the tag is missing receivers apply `r`. In relaxed mode, SPF is aligned when the Return-Path (envelope MAIL FROM) domain and the From header domain share the same Organizational Domain, so `bounce.example.com` aligns with `example.com`. In strict mode only an exact match aligns, so `bounce.example.com` fails against `example.com`. SPF alignment matters because DMARC passes only when SPF or DKIM passes *and* is aligned with the From domain.

## What does aspf mean in DMARC?

aspf means "alignment, SPF". It tells receivers which comparison to run between two domains:

- the **RFC5321.MailFrom** domain, also called Return-Path or envelope sender, which is the domain SPF actually authenticates (the HELO name is used when MAIL FROM is empty)
- the **RFC5322.From** domain, the address the recipient sees

SPF on its own never looks at the From header. A spammer can pass SPF for `their-domain.net` while showing `From: billing@yourbank.com`. Alignment is the DMARC rule that closes that gap, and aspf sets how strict that rule is. Its DKIM twin is `adkim`, which compares the DKIM `d=` domain to the From domain using the same `r` and `s` values. For the full picture of how the three records fit, see our guide to [DKIM, SPF and DMARC together](https://sendhq.cc/guides/email-dkim-spf-dmarc.md) and the short definition of [DMARC alignment](https://sendhq.cc/terms/dmarc-alignment).

A record with both tags written out looks like this:

`_dmarc.example.com. TXT "v=DMARC1; p=quarantine; aspf=r; adkim=r; rua=mailto:dmarc@example.com"`

### Why Gmail now enforces it

Consider a SaaS app that sends password resets from `no-reply@example.com` through an email provider. SPF passes, because the provider's IP is listed in the SPF record of the provider's own bounce domain. But Gmail still reports `dmarc=fail` if DKIM is also unaligned, because the domain SPF passed for is not your domain.

Since February 1, 2024, [Google requires](https://support.google.com/a/answer/81126) senders of more than 5,000 messages a day to Gmail to publish DMARC (p=none is acceptable) and to have the From domain aligned with either the SPF domain or the DKIM domain. Messages that fail authentication can be marked as spam or rejected with a `5.7.26` error. Alignment is no longer an optional extra.

## How does aspf=r vs aspf=s work?

The receiver runs two steps:

1. Check SPF for the Return-Path domain against the connecting IP. If SPF does not pass, SPF cannot contribute to DMARC regardless of aspf.
2. If SPF passed, compare that domain with the From domain using the mode set by aspf.

![DMARC evaluates SPF pass first, then compares Return-Path and From using the aspf mode](https://cdn.sanity.io/images/l4lj7ros/production/93e802eb16eaf8f0fc3a4606965c2b0b26b4e04b-1344x326.png?w=1280&auto=format)

DMARC passes if SPF or DKIM is both passing and aligned.

**Relaxed (\`aspf=r\`)**: both domains are reduced to their Organizational Domain, the registered domain found with the public suffix list (RFC 7489, section 3.2). `mail.example.com`, `bounce.example.com` and `example.com` all reduce to `example.com`, so any pairing aligns. `example.co.uk` and `mail.example.co.uk` also align, because `co.uk` is a public suffix.

**Strict (\`aspf=s\`)**: the fully qualified domain names must be identical. `example.com` aligns only with `example.com`.

### Worked example with five messages

Here are five real-shaped messages. In every row SPF itself passes; only alignment differs.

| # | From domain | Return-Path domain | aspf=r | aspf=s |
| --- | --- | --- | --- | --- |
| 1 | example.com | example.com | aligned | aligned |
| 2 | example.com | bounce.example.com | aligned | **fails** |
| 3 | mail.example.com | mail.example.com | aligned | aligned |
| 4 | app.example.com | example.com | aligned | **fails** |
| 5 | example.com | amazonses.com subdomain | **fails** | **fails** |

![Five messages where SPF passes, showing which align under relaxed and strict aspf](https://cdn.sanity.io/images/l4lj7ros/production/e93038077129b5cc7231fa1801763a3024f627a8-1344x456.png?w=1280&auto=format)

Strict mode fails every subdomain pairing that relaxed mode accepts.

Row 2 is the common case. Most email providers put bounces on a subdomain you delegate to them, such as `bounce.example.com`, so they can process bounces while your SPF stays aligned. Under relaxed alignment that works. Switch to `aspf=s` and every one of those messages loses SPF alignment, and DMARC then depends entirely on DKIM.

Row 5 shows why aspf mode is not the fix for a provider's default bounce domain. When the Return-Path belongs to a different registered domain, neither mode aligns.

## Does SPF alignment fail when sending through an ESP?

Often, yes, unless you set up a custom bounce domain. Many providers use their own domain as the Return-Path by default. [Amazon SES](https://docs.aws.amazon.com/ses/latest/dg/send-email-authentication-dmarc.html), for example, uses a subdomain of `amazonses.com` as the MAIL FROM domain unless you configure a custom MAIL FROM domain. Its documentation states that SPF alignment requires a custom MAIL FROM domain, and that a strict `aspf=s` tag must be removed for that subdomain to align.

The usual fix has two parts:

1. Configure a custom MAIL FROM (Return-Path) subdomain such as `bounce.example.com` at your provider, with the MX and SPF TXT records it gives you. Our explainer on the [Return-Path header](https://sendhq.cc/terms/return-path) covers what those records do.
2. Keep `aspf=r`, so that subdomain aligns with `example.com`.

Some providers cannot offer a custom Return-Path at all. In that case SPF will never align, and DKIM with your own `d=` domain carries DMARC on its own, as the EasyDMARC walkthrough below shows.

Video: [SPF & DKIM Alignment: A Crucial Step in Email Authentication (2024) | EasyDMARC](https://www.youtube.com/watch?v=mNaKXAoRf1I&t=117s) (EasyDMARC)

This section walks through SPF and DKIM alignment with concrete From and Return-Path pairs, then explains why email providers that own the bounce address need a CNAME for aligned return paths, and why DKIM must carry DMARC when SPF cannot align.

1. [1:57](https://www.youtube.com/watch?v=mNaKXAoRf1I&t=117s) SPF alignment defined with a subdomain example
2. [2:21](https://www.youtube.com/watch?v=mNaKXAoRf1I&t=141s) Aligned and unaligned Return-Path examples
3. [2:44](https://www.youtube.com/watch?v=mNaKXAoRf1I&t=164s) DKIM alignment compared with the d= domain
4. [3:57](https://www.youtube.com/watch?v=mNaKXAoRf1I&t=237s) Why ESP bounce domains need a CNAME, or DKIM instead

## aspf vs adkim: what is the difference?

aspf | adkim

| Compares From domain with | Return-Path (MAIL FROM) domain | DKIM signature `d=` domain |
| --- | --- | --- |
| Default | r | r |
| Survives forwarding | Usually not (the forwarder's IP fails SPF) | Usually yes, if the body is unchanged |
| Typical strict-mode breakage | Provider bounce subdomains | Signing with the parent domain while sending from a subdomain |

Because SPF breaks on forwarding and DKIM usually survives it, DKIM alignment is the more dependable path to a DMARC pass. If you want to confirm your signature first, [check for DKIM](https://sendhq.cc/guides/check-for-dkim.md) on your domain.

## Should I use strict or relaxed SPF alignment?

Use relaxed unless you have a specific reason not to. Strict SPF alignment adds little protection, because an attacker who can send from a subdomain of yours already controls DNS or a server inside your organization. It does, however, break the standard provider setup in row 2 above.

Strict mode is reasonable when:

- you send only from the exact From domain, with no provider bounce subdomains
- you have DMARC aggregate reports confirming every legitimate source aligns exactly
- different teams own different subdomains and you want each one isolated

Before tightening, run `p=none` with `rua` reports for a few weeks, then move through quarantine and reject as explained in our post on [DMARC policy p=none, quarantine and reject](https://sendhq.cc/blog/dmarc-policy-p-none-quarantine-reject).

## Common pitfalls

- **Setting aspf=s "for security"** and silently failing SPF alignment for every provider using a bounce subdomain.
- **Assuming SPF pass means DMARC pass.** Check the `smtp.mailfrom=` value in the Authentication-Results header against the From domain.
- **Expecting aspf to fix a third-party Return-Path.** Relaxed mode only helps when both domains share a registered domain.
- **Ignoring subdomain policy.** `sp=` controls policy for subdomains; it does not change alignment.

If you send product email from code or from AI agents, SendHQ sets up a verified domain with DKIM and a custom MAIL FROM, then shows per-message delivery, bounce and complaint events so you can see alignment failures as they happen. [Create a SendHQ account](https://sendhq.cc/index.md) and send your first aligned email from the API.

## FAQ

### What is the default value of aspf in DMARC?

The default is `r` (relaxed). If your DMARC record has no aspf tag, receivers treat SPF alignment as relaxed, per RFC 7489.

### Can DMARC pass if SPF alignment fails?

Yes. DMARC passes when either SPF or DKIM both passes and aligns. With an aligned DKIM signature, an unaligned SPF result does not cause a DMARC failure.

### How do I check my aspf setting?

Look up the TXT record at `_dmarc.yourdomain.com`, for example with `dig TXT _dmarc.example.com +short`. If no `aspf=` tag appears, you are using relaxed alignment. Our [DMARC check guide](https://sendhq.cc/guides/dmarc-check.md) walks through reading the result.

### Does aspf=s block subdomain spoofing?

Not meaningfully. Spoofing an unrelated domain fails alignment in both modes. Strict mode only rejects your own subdomains, which attackers cannot use without access to your DNS.

### What do aspf=r and adkim=r mean together?

Both SPF and DKIM use relaxed alignment, so either check can pass DMARC with any domain under your registered domain. This is the default and the most common setup.

## Keep reading

- [SMTP Code 550: How to Fix Every 550 Error Variant](https://sendhq.cc/blog/smtp-code-550): SMTP code 550 is a permanent rejection: the server refused the message. Read the enhanced code (5.1.1, 5.7.1, 5.7.26) to find the exact fix. Read article →
- [SMTP Errors: Reply Codes and Status Codes Reference](https://sendhq.cc/blog/smtp-errors): SMTP errors are 3-digit reply codes: 4xx is temporary and safe to retry, 5xx is permanent. Full table with enhanced codes and fixes. Read article →
- [Bounce vs Complaint: What Actually Hurts Deliverability](https://sendhq.cc/blog/bounce-vs-complaint-deliverability): Bounces are technical failures, but complaints are reputation killers. Learn how to handle both to keep your sending reputation intact and y Read article →