DMARC alignment is the check that makes SPF and DKIM count. Passing SPF or DKIM isn't enough on its own: the domain they checked has to match the domain in the From address people see.
How each one aligns
- SPF checks the Return-Path domain (the envelope sender). It aligns when that domain matches the From domain.
- DKIM checks the domain in the signature's
d=tag. It aligns when that matches the From domain.
DMARC passes when at least one of them passes and aligns.
Relaxed or strict
By default alignment is relaxed: a subdomain counts, so mail.yourdomain.com aligns with yourdomain.com. The aspf=s and adkim=s tags make it strict, requiring an exact match. Relaxed is right for almost everyone.
Why it fails
A sending tool that signs with its own domain instead of yours, or uses its own Return-Path, passes SPF and DKIM but fails alignment. With Google Workspace and your own DKIM key switched on, DKIM aligns by itself.