Explore six exact-domain combinations
This fictional model assumes an applicable strict-alignment policy and the pass/fail results you select. It does not inspect a real message, DNS, public suffixes, subdomain policy, organizational-domain alignment, or receiver disposition.
JavaScript is required for the model.
All expected examples
Both pass and match
Both assumed passes use the same domain as From. ASCII case does not create a different domain.
{
"spf": {
"authenticated": true,
"domainMatches": true,
"aligned": true
},
"dkim": {
"authenticated": true,
"domainMatches": true,
"aligned": true
},
"passesModel": true
}Authentication pass without alignment
SPF passes for sender.example, which is not news.example. Failed DKIM supplies no authenticated match.
{
"spf": {
"authenticated": true,
"domainMatches": false,
"aligned": false
},
"dkim": {
"authenticated": false,
"domainMatches": false,
"aligned": false
},
"passesModel": false
}DKIM supplies the match
SPF does not pass. Matching, passing DKIM alone supplies the modeled authenticated identifier.
{
"spf": {
"authenticated": false,
"domainMatches": true,
"aligned": false
},
"dkim": {
"authenticated": true,
"domainMatches": true,
"aligned": true
},
"passesModel": true
}SPF supplies the match
Matching, passing SPF supplies the modeled identifier even though passing DKIM uses another domain.
{
"spf": {
"authenticated": true,
"domainMatches": true,
"aligned": true
},
"dkim": {
"authenticated": true,
"domainMatches": false,
"aligned": false
},
"passesModel": true
}Matching text without authentication
Both domain strings match, but neither assumed authentication result passes. Text matching alone is insufficient.
{
"spf": {
"authenticated": false,
"domainMatches": true,
"aligned": false
},
"dkim": {
"authenticated": false,
"domainMatches": true,
"aligned": false
},
"passesModel": false
}Subdomain is not an exact match
mail.news.example differs from news.example under strict matching. Relaxed or organizational-domain behavior is not modeled.
{
"spf": {
"authenticated": true,
"domainMatches": false,
"aligned": false
},
"dkim": {
"authenticated": true,
"domainMatches": false,
"aligned": false
},
"passesModel": false
}Download the standalone practice kit
Separate two questions
An authentication pass and domain alignment answer different questions. This local model takes an assumed SPF/DKIM result and compares each authenticated domain with the visible From domain using strict exact-domain equality, ignoring ASCII letter case.
It assumes an applicable strict policy and a valid message. It does not query DNS or verify a signature, SPF authorization, a real email, public suffixes, organizational domains, or receiver actions.
Use the examples to explain a result
Try a passing authenticated domain that differs from From, then a matching domain whose authentication failed. At least one assumed mechanism must both pass and align in this limited model. A subdomain is different under strict equality.
RFC 9989 is the current DMARC specification cited for this exercise. Relaxed alignment and organizational-domain discovery require additional supported rules and are deliberately outside this implementation.
Sources & verification
Product details and prices can change. Check the linked provider before buying.
- RFC 9989: Domain-based Message Authentication, Reporting, and Conformance Accessed 2026-09-14
Sources link directly to providers. Product buttons may use separately labeled affiliate links. Read our disclosure.