DMARC uses relaxed DKIM alignment (adkim=r)
The observed DMARC policy uses relaxed DKIM alignment (adkim=r). Relaxed alignment compares organizational domains; strict alignment (adkim=s) requires an exact domain match. This is separate from validating the DKIM signature. Other audit tools often report this finding as "adkim=r (relaxed DKIM alignment)".
Why this matters
Relaxed alignment is a valid policy choice, not an automatic authentication failure. Review legitimate sending services and control over aligned subdomains. Strict matching can be appropriate in some deployments but may disrupt legitimate senders that use another aligned subdomain.
How to fix it
Inventory the services that send mail as the business and inspect representative received message authentication results. Ask the email administrator to choose alignment modes based on those sending paths and subdomain ownership. Test before publishing a stricter policy; do not change adkim merely to clear an audit warning. A public DNS observation cannot establish that all business mail is safe or deliverable.
Turn website findings into an action plan
Create an account to start a Full Audit of your website, with supporting evidence and a prioritised action plan.
Start Full Audit