Explore six exact-domain combinations
This fictional model assumes an applicable strict-alignment policy and the pass/fail results you select. It does not inspect a real message, DNS, public suffixes, subdomain policy, organizational-domain alignment, or receiver disposition.
JavaScript is required for the model.
All expected examples
Both pass and match
Both assumed passes use the same domain as From. ASCII case does not create a different domain.
{
"spf": {
"authenticated": true,
"domainMatches": true,
"aligned": true
},
"dkim": {
"authenticated": true,
"domainMatches": true,
"aligned": true
},
"passesModel": true
}Authentication pass without alignment
SPF passes for sender.example, which is not news.example. Failed DKIM supplies no authenticated match.
{
"spf": {
"authenticated": true,
"domainMatches": false,
"aligned": false
},
"dkim": {
"authenticated": false,
"domainMatches": false,
"aligned": false
},
"passesModel": false
}DKIM supplies the match
SPF does not pass. Matching, passing DKIM alone supplies the modeled authenticated identifier.
{
"spf": {
"authenticated": false,
"domainMatches": true,
"aligned": false
},
"dkim": {
"authenticated": true,
"domainMatches": true,
"aligned": true
},
"passesModel": true
}SPF supplies the match
Matching, passing SPF supplies the modeled identifier even though passing DKIM uses another domain.
{
"spf": {
"authenticated": true,
"domainMatches": true,
"aligned": true
},
"dkim": {
"authenticated": true,
"domainMatches": false,
"aligned": false
},
"passesModel": true
}Matching text without authentication
Both domain strings match, but neither assumed authentication result passes. Text matching alone is insufficient.
{
"spf": {
"authenticated": false,
"domainMatches": true,
"aligned": false
},
"dkim": {
"authenticated": false,
"domainMatches": true,
"aligned": false
},
"passesModel": false
}Subdomain is not an exact match
mail.news.example differs from news.example under strict matching. Relaxed or organizational-domain behavior is not modeled.
{
"spf": {
"authenticated": true,
"domainMatches": false,
"aligned": false
},
"dkim": {
"authenticated": true,
"domainMatches": false,
"aligned": false
},
"passesModel": false
}Download the standalone practice kit
Predict the alignment result before running the exercise
In this synthetic case, the visible From domain is example.com. SPF passes for mail.example.com, DKIM passes for example.com, and this exercise uses strict alignment. Which passing mechanism aligns? Write your prediction, then enter those values into the exercise.
The DKIM domain is an exact match; the SPF domain is not. Now change only the DKIM domain to another.example.com: both mechanisms can still pass authentication while neither matches the From domain under this strict model. This exercise does not simulate DNS, message delivery or a full production policy evaluation.
Choose the next check from the mismatch
If the distinction is still unclear, continue with SPF and DKIM pass, but email still fails: check alignment and record the visible From domain separately from each authenticated domain. If your actual problem is lost subscriber data rather than delivery, Compare a CSV export with its original is the relevant next task. Do not buy another sending tool until you can name the failure.
Separate two questions
An authentication pass and domain alignment answer different questions. This local model takes an assumed SPF/DKIM result and compares each authenticated domain with the visible From domain using strict exact-domain equality, ignoring ASCII letter case.
It assumes an applicable strict policy and a valid message. It does not query DNS or verify a signature, SPF authorization, a real email, public suffixes, organizational domains, or receiver actions.
Use the examples to explain a result
Try a passing authenticated domain that differs from From, then a matching domain whose authentication failed. At least one assumed mechanism must both pass and align in this limited model. A subdomain is different under strict equality.
RFC 9989 is the current DMARC specification cited for this exercise. Relaxed alignment and organizational-domain discovery require additional supported rules and are deliberately outside this implementation.
Sources & verification
Product details and prices can change. Check the linked provider before buying.
- RFC 9989: Domain-based Message Authentication, Reporting, and Conformance Accessed 14 Sep 2026
Sources link directly to providers. Product buttons may use separately labeled affiliate links. Read our disclosure.