What happens if adkim is missing?

DMARC uses relaxed DKIM alignment, equivalent to adkim=r.

Does adkim=s make DKIM cryptographically stronger?

No. It changes the domain-match requirement for DMARC. Key type, key size, signature validity, and content integrity are separate DKIM concerns.

Does strict alignment improve deliverability?

Not automatically. It can express a tighter identity policy, but it can also make legitimate mail fail DMARC if signing domains are not exact matches.

Can SPF still make DMARC pass under adkim=s?

Yes. DMARC can pass through an aligned SPF result even when no DKIM signature strictly aligns, unless another local rule says otherwise.

Should every domain use strict alignment?

No universal rule requires it. Use strict mode only when the organization controls every needed exact signing identity and has verified all production sources.

What does the DMARC adkim tag do?

Q: What are the requirements?

RFC 9989 defines adkim as optional. The value r selects relaxed mode and is the default. The value s selects strict mode. In relaxed mode, the DKIM authenticated identifier and Author Domain can align when their Organizational Domains are the same. A signature with d=mail.example.com can therefore align with From example.com when policy discovery identifies the same Organizational Domain. In strict mode, the domains must match exactly. That same d=mail.example.com signature does not strictly align with From example.com. It can strictly align with From mail.example.com. The signature must pass DKIM before alignment helps DMARC. adkim does not repair an invalid signature and does not change th

The DMARC adkim tag chooses how closely a passing DKIM signing domain must match the visible From domain. adkim=r is relaxed alignment and is the default when the tag is omitted. Related subdomains can align when they share the same Organizational Domain. adkim=s is strict alignment and requires an exact domain match. The tag does not make DKIM pass, change the DKIM key, or affect SPF alignment. Test every production sender before moving to strict mode.

Quick takeaways

adkim controls DKIM identifier alignment for DMARC.
Relaxed alignment, adkim=r, is the default.
Strict alignment, adkim=s, requires an exact domain match.
The comparison uses a passing DKIM signature's d= domain and the visible From domain.
A stricter setting can break DMARC for legitimate subdomain or parent-domain signing.

DMARC adkim changes only DKIM alignment, shown as a four-step technical sequence.

This diagram summarizes the article's diagnostic sequence. Use the linked standards, current provider documentation, and production evidence for exact decisions. Open the full-size diagram.

Who is affected?

The tag affects domains that rely on DKIM to satisfy DMARC, particularly when third-party services sign with a parent domain, sending subdomain, or provider-owned domain. It also affects MSPs applying one DMARC template across clients with different signing designs.

Review the DKIM overview and DMARC overview before changing the mode. A DNS record alone cannot show every signing domain used in production.

What are the requirements?

RFC 9989 defines adkim as optional. The value r selects relaxed mode and is the default. The value s selects strict mode.

In relaxed mode, the DKIM authenticated identifier and Author Domain can align when their Organizational Domains are the same. A signature with d=mail.example.com can therefore align with From example.com when policy discovery identifies the same Organizational Domain.

In strict mode, the domains must match exactly. That same d=mail.example.com signature does not strictly align with From example.com. It can strictly align with From mail.example.com.

The signature must pass DKIM before alignment helps DMARC. adkim does not repair an invalid signature and does not change the separate SPF alignment mode controlled by aspf.

When does the requirement take effect?

The selected mode applies when a receiver evaluates a passing DKIM signature against the visible From domain under the discovered DMARC policy. Omitting adkim applies relaxed mode.

A change to strict mode can affect the next messages evaluated after receivers obtain the new DNS record. Cached policy records can create a transition period, so observe both headers and aggregate data.

How do I implement the requirement?

1. Inventory every DKIM signing domain

Use delivered messages and aggregate reports to list the passing d= value for every mailbox, campaign, billing, support, and alert source.

2. Compare each value with the From domain

Mark which signatures align only through the Organizational Domain and which are exact matches. Do not infer the signing domain from a DNS selector inventory.

3. Fix legitimate non-aligned senders

Enable a custom DKIM domain where supported, change the visible From domain deliberately, or rely on a separately aligned SPF path while keeping DKIM healthy.

4. Publish the chosen mode once

Use adkim=r for relaxed behavior or adkim=s for strict behavior in the single DMARC policy record. Preserve other approved policy and reporting tags.

5. Roll out strict mode with evidence

If strict alignment is required by policy, test low-risk sources first and watch normal traffic before treating the change as complete.

How do I validate compliance?

For each source, inspect a delivered message and confirm DKIM pass, the expected d= value, the visible From domain, and DMARC pass. Check aggregate data for sources that appear infrequently and for any new strict-alignment failures.

Use the DNS lookup tool to verify the policy and selectors, then Email Security Score for public configuration. Production messages and reports are the evidence that every sender still aligns.