In DMARC, the "adkim" tag stands for "Alignment Mode for DKIM."
adkim specifies how DKIM (DomainKeys Identified Mail) signatures should be aligned with the email's From domain when evaluating DMARC policy.
Setting the adkim tag: In your DMARC record, you specify the "adkim" tag followed by one of two possible values:
- ( "adkim=r" ) - Relaxed: This means that DKIM signatures must only partially match the email's From domain.
- ( "adkim=s" ) - Strict: This requires a strict alignment between the DKIM signature's From domain. The DKIM signature must exactly match the email's From domain.
- Alignment of DKIM signatures: DKIM signatures are cryptographic headers added to email messages by the sending server. These signatures help verify the authenticity of the email and ensure it has not been tampered with during transit. The "adkim" tag specifies how the domain specified in the DKIM signature should align with the email's From domain when it's DMARC policy is evaluated.
- Relaxed vs. Strict alignment: The choice between relaxed and strict alignment affects how strict the DMARC policy enforcement is regarding DKIM signatures. Relaxed alignment allows for more flexibility by matching DKIM signatures against organizational domains (the parent domain) or their immediate ancestor subdomains, while strict alignment requires an exact match between the DKIM signature domain and the email's From domain.
- Considerations: The alignment mode specified by the "adkim" tag can impact DMARC policy enforcement and email deliverability. Choosing the appropriate alignment mode depends on your organization's email authentication practices, DKIM implementation, and requirements for DMARC policy enforcement.
By setting the "adkim" tag in your DMARC record, you can specify how DKIM signature alignment should be evaluated when enforcing DMARC policy, helping enhance email security and protect against email spoofing and phishing attacks.