# DKIM Alignment Child Domain vs Org Domain

**URL:** <https://forum.dmarcian.com/t/dkim-alignment-child-domain-vs-org-domain/1792>\
**Category:** Technical Help\
**Created:** [May 11, 2022, 7:50pm UTC](https://forum.dmarcian.com/t/dkim-alignment-child-domain-vs-org-domain/1792 "2022-05-11T19:50:53Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![southwick](https://avatars.discourse-cdn.com/v4/letter/s/439d5e/32.png) [@southwick](https://forum.dmarcian.com/u/southwick)\
**Post date:** [May 11, 2022, 7:50pm UTC](https://forum.dmarcian.com/t/dkim-alignment-child-domain-vs-org-domain/1792/1 "2022-05-11T19:50:53Z")

</div>

Question on alignment.  
Most examples I see state that for relaxed alignment state that the The Mail From or Envelope From domain is a subdomain of the From domain for alignment.

e.g. [example.company.com](http://example.company.com) aligns with [company.com](http://company.com)

The RFC states that:

In relaxed mode, the Organizational Domains of both the [DKIM]-  
authenticated signing domain (taken from the value of the “d=” tag in  
the signature) and that of the RFC5322.From domain must be equal if  
the identifiers are to be considered aligned. In strict mode, only  
an exact match between both of the Fully Qualified Domain Names  
(FQDNs) is considered to produce Identifier Alignment.

To me that reads that as long as the signing domain and from domain match the organizational/root domain the they align.

Use case, we are looking at a vendor and I am trying to determine if relaxed alignment will work with both our student and staff domains:

DKIM Signing = mail.campus.edu  
student FROM domain = my.campus.edu  
staff FROM domain = campus.edu

From my testing using OPENDKIM, it seems like my reading of the RFC is correct, but wanted to see if anyone else had input.

My Test resuts:  
spf=none (sender IP is xxx.xxx.xxx.xxx) smtp.mailfrom=bogus.campus.edu; dkim=pass (signature was verified) header.d=test.campus.edu;dmarc=pass action=none header.from=email.campus.edu;

---

<div class="post-metadata">

**Author:** ![Asher](https://yyz2.discourse-cdn.com/flex036/user_avatar/forum.dmarcian.com/asher/32/104_2.png) [@Asher](https://forum.dmarcian.com/u/Asher)\
**Post date:** [May 13, 2022, 4:00pm UTC](https://forum.dmarcian.com/t/dkim-alignment-child-domain-vs-org-domain/1792/2 "2022-05-13T16:00:27Z")

</div>

Hi southwick,

You are correct that alignment is where the organizational level domain of the SPF or DKIM domain identity matches the organizational level domain of the from: header. The organizational level domain is the first private domain prepending a public suffix. In your case the public suffix being the .edu TLD. Campus would then be the private label, making campus.edu the org domain.

With that in mind, this is correct.

From: [sub.campus.com](http://sub.campus.com)  
DKIM: [campus.com](http://campus.com)  
SPF: [mail.campus.com](http://mail.campus.com)

All three are aligned. Any amount of subdomains also does not matter.

I hope this helps.