DMARC adkim Tag

What Is the DMARC adkim Tag

The DMARC adkim tag defines how strictly DKIM alignment is evaluated when a receiving mail server checks incoming messages.

It tells the recipient’s system whether the DKIM-signed domain must exactly match the domain in the visible “From” address, or whether a subdomain match is acceptable.

This tag plays a key role in determining whether a message passes DMARC authentication.

How the adkim Tag Works

The adkim tag appears in a DMARC DNS record and can take one of two values:

• adkim=r — Relaxed mode. DKIM passes if the signing domain and the “From” domain share the same Organizational Domain. For example, an email from mailer.example.com aligns with example.com.
• adkim=s — Strict mode. DKIM passes only if the domains are identical. For instance, mailer.example.com would not align with example.com under strict mode.

Example DMARC record:

In this example, DKIM alignment is strict, while SPF alignment is relaxed.

Choosing the Right Alignment Mode

The right adkim setting depends on your domain structure and how your organization sends email.

• Relaxed alignment (adkim=r) is the most common setting, offering flexibility for subdomain senders while maintaining security.
• Strict alignment (adkim=s) provides tighter control and stronger anti-spoofing protection but requires precise domain matching, which can lead to more authentication failures if subdomains aren’t fully configured.

Organizations often begin with relaxed alignment and move to strict once they’ve verified all legitimate senders are properly authenticated.

DMARC adkim and DMARCeye

DMARCeye helps organizations see how their DKIM alignment behaves across all sending sources.

By analyzing DMARC aggregate reports, DMARCeye identifies which senders pass or fail alignment under your current adkim mode. This allows you to spot potential misalignments, adjust your DKIM signatures, and choose the right enforcement level with confidence.

With this insight, teams can move from relaxed to strict alignment strategically — improving security without disrupting legitimate mail flow.