DMARC aspf= Tag: SPF Alignment (aspf)
The DMARC aspf tag controls how strictly the SPF MAIL FROM domain must match the From header domain. "r" allows subdomain matches; "s" requires exact match.
Published · Last verified · Maintained by TamingDNS
Optional
aspf=
r (relaxed)
aspf=r
✅ Valid Values
r
Relaxed (default). Organisational domain matching. Subdomains align with parent.
s
Strict. The SPF envelope-from domain must exactly match the From header domain.
💬 What This Tag Does
The "aspf" tag controls how strictly DMARC compares the SPF envelope-from (SMTP MAIL FROM) domain with the email's From header domain. Relaxed mode allows organisational domain matching. Strict mode requires an exact match. Most deployments use relaxed alignment to accommodate bounce addresses and subdomains. Note: RFC 9989 (DMARCbis) uses MAIL FROM only for SPF alignment. The HELO fallback allowed in RFC 7489 has been removed.
📋 Complete Example Records
Every one of these is a complete record you can paste as it stands. Each goes in a TXT record at
_dmarc.yourdomain.com. Check yours with the
DMARC Checker
or assemble one in the
DMARC Builder.
v=DMARC1; p=reject; rua=mailto:dmarc-feedback@example.com
Relaxed by default. A MAIL FROM of sender@child.example.com aligns with a From address at example.com, since both resolve to the same organisational domain.
v=DMARC1; p=reject; aspf=s; rua=mailto:dmarc-feedback@example.com
Strict. The MAIL FROM domain must match the From domain exactly, which breaks the moment a provider uses its own bounce domain.
v=DMARC1; p=reject; aspf=s; adkim=s; rua=mailto:dmarc-feedback@example.com
Both strict, as gov.uk publishes. Worth doing once every sender is under your own domain, and painful before that.
v=DMARC1; p=reject; aspf=s; adkim=r; rua=mailto:dmarc-feedback@example.com
SPF pinned, DKIM relaxed. DMARC needs only one aligned identifier, so a relaxed DKIM signature can still carry mail that strict SPF rejects.
📚 RFC References
🔗 Related DMARC Tags
🛡️ Related Tools
Analyse your current DMARC record, build a new one, or read the aggregate reports that tell you whether the policy is safe to tighten.