Skip to content
correct.email
correct.email
Email authentication

SPF vs DKIM vs DMARC: what each one does

SPF, DKIM and DMARC solve different parts of email authentication. What each checks, why you need all three, and how alignment ties them together.

By Exmoor Software4 min read

SPF, DKIM and DMARC are usually mentioned in one breath, but they answer three different questions:

  • SPF: is this server allowed to send mail for the envelope sender’s domain?
  • DKIM: was this message signed by a domain, and has it been changed since?
  • DMARC: does either of those results belong to the domain in the From address, and if not, what should happen to the message?

None of them is enough on its own. Together they let a receiver decide whether a message really comes from the domain it shows to the reader.

Side by side

SPFDKIMDMARC
SpecificationRFC 7208RFC 6376 (+ RFC 8301, 8463)RFC 9989 (2026)
Published asTXT on the sending domainTXT at selector._domainkey.domainTXT at _dmarc.domain
Authenticatesenvelope sender domain (MAIL FROM)the signing domain d=nothing new — evaluates SPF and DKIM
Based onIP address of the sending servercryptographic signaturealignment with the From header
Survives forwardingnousually, unless the message is modifieddepends on SPF/DKIM
Tells receivers what to dononoyes (p=none, quarantine, reject)
Sends you reportsnonoyes (rua=)

SPF: who may send

The domain lists permitted servers in DNS; the receiver compares the connecting IP address with that list. It is simple, but it only covers the envelope sender — the bounce address — which readers never see, and it breaks when a message is forwarded, because the forwarding server is not on your list. Details in What is SPF and how does it work?.

DKIM: a signature that travels with the message

The sending server signs selected headers and the body with a private key and adds a DKIM-Signature header:

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=example.com; s=s2026;
        h=from:to:subject:date:message-id; bh=…; b=…

The receiver fetches the public key from s2026._domainkey.example.com and verifies the signature. A valid signature proves that example.com took responsibility for the message and that the signed parts weren’t altered. Because the signature is inside the message, it survives forwarding — until something rewrites the subject or appends a footer, as many mailing lists do.

Use RSA keys of at least 1024 bits (2048 recommended); verifiers must reject shorter keys and SHA-1 signatures (RFC 8301). The DKIM checker validates a published key.

Neither SPF nor DKIM looks at the From address. A phisher can send from their own server with their own SPF record and their own DKIM signature — both pass — while the From header says your company.

DMARC closes that gap with alignment: it passes only if SPF or DKIM passed for a domain that matches the From domain. And it lets you publish a policy for messages that fail.

Alignment by example

Your newsletter tool sends a message with:

From: Example Shop <news@example.com>
Return-Path: <bounce-7f3a@em.mailer.example-esp.net>
DKIM-Signature: … d=mailer.example-esp.net …

SPF passes for mailer.example-esp.net, DKIM passes for mailer.example-esp.net — and DMARC fails, because neither is example.com. Two fixes, each sufficient on its own:

  1. Custom DKIM: let the service sign with d=example.com (you publish its key, often as a CNAME). DKIM is then aligned.
  2. Custom return-path: let the service use a bounce domain such as bounce.example.com. SPF is then aligned in relaxed mode.

Do the first one if you only do one: DKIM survives forwarding, SPF doesn’t.

Do I need all three?

Yes, if you send email from your domain to the major mailbox providers:

  • Gmail requires SPF or DKIM from everyone, and SPF and DKIM plus a DMARC record (p=none is enough) from senders of more than 5,000 messages a day to Gmail accounts.
  • Yahoo applies similar rules to bulk senders.
  • Microsoft has required SPF, DKIM and DMARC for senders of more than 5,000 messages a day to Outlook.com, Hotmail.com and Live.com since May 2025.

Even below those volumes, mail with all three aligned is simply more likely to reach the inbox, and an enforcing DMARC policy is the only one of the three that actually stops spoofing of your domain.

What about forwarding and mailing lists?

Forwarding breaks SPF; mailing lists that modify messages break DKIM. When both fail, DMARC fails through no fault of yours. Large receivers use ARC (Authenticated Received Chain, RFC 8617): intermediaries record the authentication results they saw before changing the message, and receivers that trust the intermediary can honor them. You can’t configure ARC for other people’s lists, but signing all your mail with DKIM keeps the impact small.

A quick checklist

  1. One SPF record that covers every service sending with your domain, under 10 DNS lookups — SPF checker.
  2. DKIM signing with your domain in every sending service, 2048-bit keys where possible — DKIM checker.
  3. A DMARC record with a rua address, starting at p=none and moving to p=reject — DMARC checker, and the step-by-step DMARC guide.
  4. Verify on a real message: spf=pass, dkim=pass and dmarc=pass in the Authentication-Results header — email header analyzer.

References