DMARC uses relaxed DKIM alignment (adkim=r)

DMARC (Domain-based Message Authentication, Reporting and Conformance) is a DNS record that tells receiving mail servers how strictly to check whether an email claiming to be from your domain is genuine. One setting, DKIM (DomainKeys Identified Mail) alignment, controls how exactly the signing domain has to match. This check looks at that setting. On this site's domain, DMARC uses the relaxed alignment mode (adkim=r) rather than the strict mode (adkim=s). Relaxed alignment allows email sent from spoofed sub-domains of your domain to still pass DKIM authentication checks, which is a real, if less common, spoofing vector attackers can use to send convincing fraudulent email that appears to come from the business. Strict alignment closes this specific gap by requiring an exact domain match. Your DNS provider or whoever manages your DMARC record should change adkim=r to adkim=s in the DMARC TXT record. This matters most if the business has lax sub-domain hygiene, since most teams do want strict alignment by default. Test the change with a DMARC analysis tool before fully enforcing it, to avoid accidentally breaking legitimate mail. Around 10 minutes.