Free tools Windows power users keep installed
One-click scans. No signup required.
For DMARC to pass, at least one of two checks must both authenticate and align with the domain in the message’s visible From address: SPF for the SMTP MAIL FROM domain, or DKIM for the signature’s d= domain. A Node.js app can add a DKIM signature, but it cannot by itself publish the DNS records, configure a mail provider’s sending domain, or establish that a receiving server will accept the message.
What “tenant alignment” means for a Node.js sender
“Tenant” can mean an organization’s email domain or its account on a sending provider. Neither meaning describes a special Node.js or DMARC feature. DMARC evaluates domain identities in the message and compares them with the domain in the RFC 5322 From field, called the Author Domain. A provider account may handle sending for an organization, but the relevant question is whether the authenticated domains for that message align with its Author Domain.
As an Amazon Associate I earn from qualifying purchases.
Keep these identities distinct when configuring a system:
Quick wins for a faster PC:
Repair Windows errors before they cause bigger problemsFix Now →Scan for outdated or missing drivers - takes under a minuteDriver Scan →Clear out junk files and repair common Windows errorsFree Scan →- Author Domain: the domain in the visible
Fromaddress. - SPF identity: SPF can evaluate the SMTP HELO/EHLO identity or the
MAIL FROMidentity. DMARC uses SPF validation ofMAIL FROMfor its alignment check. - DKIM signing domain: the domain in the
d=tag of a DKIM signature that verifies successfully.
A passing authentication result alone is not enough: the identity that passed must also align with the Author Domain for that mechanism to count toward DMARC.
#1 Best Overall
How SPF, DKIM, and DMARC work together
| Mechanism | What it authenticates | What DMARC compares | What configuration it needs |
|---|---|---|---|
| SPF | Whether a sending host is authorized for the evaluated SMTP identity. | The validated MAIL FROM domain against the Author Domain. A HELO/EHLO SPF pass alone does not supply DMARC’s SPF alignment. |
An SPF DNS TXT record that authorizes the actual sending source, plus an envelope-sender domain that can align. |
| DKIM | A cryptographic signature associating a signing domain with signed message content. | The verified signature’s d= domain against the Author Domain. |
A signer with a private key and a corresponding public key published in DNS for the selector and signing domain. |
| DMARC | It does not sign or authenticate the message itself; it evaluates aligned SPF and DKIM results. | Whether at least one supported authenticated identifier aligns with the Author Domain. | A DMARC TXT record at _dmarc.<author-domain>, with policy and any desired reporting instructions. |
SPF authorization is based on DNS-published policy for the relevant SMTP identity. DKIM lets a receiver retrieve a public key from DNS to verify the signature. DKIM is not encryption, does not authenticate the local part of an email address, and does not prove who a human author is. A valid DKIM signature from an unrelated domain does not establish DMARC alignment with the visible sender domain.
Choose relaxed or strict alignment
Alignment mode controls how exact the domain comparison must be. Relaxed alignment accepts domains with the same Organizational Domain; strict alignment requires the authenticated domain and Author Domain to be identical. SPF and DKIM alignment modes are evaluated separately.
| Mode | Comparison | Operational effect |
|---|---|---|
| Relaxed | Same Organizational Domain | A parent domain and a subdomain can align when they share that Organizational Domain. A provider-specific domain outside it will not align merely because the provider sends mail for the organization. |
| Strict | Exact domain match | The authenticated domain must exactly match the Author Domain. A subdomain and its parent are different identities for this comparison. |
Neither mode is universally preferable. Relaxed alignment accommodates some parent-domain and subdomain arrangements; strict alignment narrows which domain identities qualify. Choose based on the domains your legitimate senders actually use and the policy you intend to enforce.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
What Nodemailer can configure
Nodemailer can sign outbound mail with DKIM. Its DKIM documentation describes transporter-level settings and per-message dkim settings, with message-level settings taking precedence. The selector identifies the DNS key entry, and the signing domain in domainName becomes the signature’s d= domain. Check the API against the version of Nodemailer installed in your application.
const nodemailer = require("nodemailer");
const transporter = nodemailer.createTransport({
host: process.env.SMTP_HOST,
port: Number(process.env.SMTP_PORT),
secure: true,
auth: {
user: process.env.SMTP_USER,
pass: process.env.SMTP_PASS
},
dkim: {
domainName: "mail.example.com",
keySelector: "s1",
privateKey: process.env.DKIM_PRIVATE_KEY
}
});
await transporter.sendMail({
from: "Notifications <[email protected]>",
to: "[email protected]",
subject: "Account update",
text: "Your account has been updated."
});This example shows application-side signing only. The public key corresponding to the private key must be published in DNS at the selector’s key name for the signing domain. To qualify for relaxed DKIM alignment with [email protected], a verified signature’s d= domain must share its Organizational Domain; under strict alignment, it must be exactly example.com. If a provider signs the message instead, configure and verify that provider’s signing domain and DNS key rather than assuming the app’s settings govern its signature.
The application call does not create an SPF record, publish a DMARC policy, change the provider’s SMTP envelope domain, or prove receiver-side DMARC success. Those are separate DNS, provider, and receiver-evaluation tasks.
Roll out alignment without disrupting legitimate mail
Use an inventory-first rollout. The order below is a practical deployment approach, not a guaranteed deliverability recipe.
PC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minute- Map each sender. For every system that sends as your domain, record the visible
Fromdomain, SMTPMAIL FROMdomain, and DKIMd=domain. Include application mail and third-party services. - Configure SPF for actual sending sources. Confirm the SPF DNS TXT policy authorizes each legitimate source. Check the evaluated
MAIL FROMidentity and whether it aligns with the Author Domain in your chosen mode; do not treat a HELO/EHLO-only pass as aligned SPF for DMARC. - Configure and publish DKIM. Arrange signing with a private key and publish the matching public key for the selected signing domain and selector. Verify that the signature’s
d=domain aligns with the visible From-domain. - Publish DMARC at the right name. Place the TXT record at
_dmarc.<author-domain>. Set the policy and alignment options deliberately, and provide an aggregate-report destination if you intend to collect reports. Make sure the record is for the Author Domain you are evaluating. - Review authentication results and reports before tightening policy. Identify legitimate senders that are missing or misconfigured, then decide whether to change policy based on observed traffic. RFC 9989 states: “Proper consumption and analysis of DMARC aggregate reports are essential to any successful DMARC deployment for a Domain Owner.”
Diagnose a DMARC alignment failure
Follow the failed message’s results one identity at a time. A DMARC failure does not by itself show that the message is spoofed: forwarding, mailing lists, provider configuration, or an overlooked legitimate sender may affect the outcomes.
- SPF: Did SPF pass for the message’s
MAIL FROM, or only for HELO/EHLO? If it passed, does that MAIL FROM domain align with the Author Domain under the configured SPF mode? - DKIM: Did a signature verify? Which
d=domain signed it, and does that domain align? A signature from another domain can be valid without being aligned. - Message changes: Did a provider, forwarder, or mailing list modify a signed header or the message body after signing?
- DNS and sender coverage: Is the DMARC record published for the domain in the visible From address? Are all legitimate sending services represented in SPF, DKIM configuration, and report review?
RFC 9989 is the current DMARC specification identified here; it obsoletes RFC 7489 and RFC 9091. Use it for current DMARC semantics rather than assuming an older RFC 7489-based explanation still covers every detail. SPF and DKIM are specified separately in RFC 7208 and RFC 6376.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
