adkim

Adkim is a DMARC tag that specifies the alignment mode used for DKIM authentication in DMARC evaluation. The tag accepts two values: r for relaxed and s for strict. The chosen mode determines how closely the domain in the DKIM signature’s d= tag must match the domain in the message From header for DKIM alignment to count.

In strict mode (adkim=s), the DKIM signer domain must exactly match the From domain. For example, a message with From: [email protected] and a DKIM signature with d=example.com would align strictly, while a signature with d=sub.example.com would not.

In relaxed mode (adkim=r), the DKIM signer domain only needs to share the same organizational domain as the From domain. For instance, if From is [email protected], a DKIM d=sub.example.com or d=example.com could align under relaxed rules, depending on the organizational-domain determination using the public suffix list. The effect is that subdomains can be treated as aligned with the parent domain.

Adkim works together with aspf, which governs SPF alignment, and together they influence DMARC evaluation: a message passes DMARC if DKIM passes with adkim alignment or SPF passes with aspf alignment, and it fails otherwise. In DNS, adkim is specified as part of the DMARC record, such as v=DMARC1; p=reject; adkim=r; aspf=s; rua=mailto:[email protected].