deliverlensBuild the identity matrix
For each message stream, record the visible From Author Domain, passing SPF domain, and every passing DKIM d= domain. Evaluate SPF and DKIM independently. An example matrix might show:
| Author Domain | SPF domain | DKIM domain | Relaxed outcome | Strict outcome |
|---|---|---|---|---|
news.example.com | bounce.example.com | news.example.com | both may align | DKIM aligns; SPF does not |
example.com | provider.example | mail.example.com | DKIM may align | neither is exact |
These are illustrative. Use current RFC 9989 organizational-domain discovery for real names.
Understand the policy controls
aspf=r and adkim=r select relaxed alignment and are defaults. aspf=s and adkim=s require exact domain matches for their respective paths. Strict SPF therefore often requires a MailFrom domain identical to the visible From domain, while strict DKIM requires the signing domain to equal it.
Strict mode is not “better security” in isolation. It may support an organization that deliberately isolates business units and controls exact identities. It may also break a legitimate provider configuration that uses an aligned subdomain under relaxed mode.
Include current domain discovery
RFC 9989 replaced the old dependency on a public suffix list with DNS tree walks and introduced psd behavior. Explicit DMARC records can affect which domain is treated as organizational. Test the actual published hierarchy, especially for delegated departments, hosted suffixes, and deep subdomains.
Choose and verify
State the threat or governance objective: preventing sibling subdomains from satisfying alignment, maintaining provider interoperability, or isolating brands. Identify streams that would fail under the candidate mode and fix or explicitly accept them before changing DNS.
Publish through normal change control with rollback. Send fresh tests from every affected stream, including forwarded or mailing-list paths that matter. Monitor aggregate reports and SMTP/recipient support evidence.
Document the final setting and why it exists. A reviewer should be able to see both the added control and the operational cost. If the organization cannot inventory exact identities, switching to strict alignment is a discovery gamble, not a controlled security improvement.