In order for an email to pass DMARC, it must pass authentication with either SPF or DKIM in an aligned way. Alignment is defined as follows:
SPF
In order for an email to be considered SPF aligned, the organizational domain in the Return Path of the email (Also known as the EnvelopeFrom or RFC5321.MailFrom) must match the organizational domain in the user-visible From address (also known as the RFC5322.From).
Examples:
An email is sent with a From address of [email protected]. and the Return Path is mail.example.com. In this case, the email is considered to be SPF aligned.
An email is sent with a From address of [email protected]. and the Return Path is mail.acme.com. In this case, the email is not aligned
DKIM
In order for an email to be considered DKIM aligned, the authenticated signing domain of at least one of the DKIM keys in the email headers must match the user-visible From address of the email ( also known as the RFC5322.From ).
An email is sent with a From address of [email protected]. There are two DKIM keys associated with the email. One authenticated signing domain is acme.com and the other is example.com. This email is considered to be DKIM aligned.
An email is sent with a From address of [email protected]. There are two DKIM keys associated with the email. One authenticated signing domain is acme.com and the other is badexample.com. This email is not considered to be DKIM aligned.