SPF proves the sending server is authorized for the envelope domain. DKIM proves a domain signed the message and the signed parts were not altered. DMARC proves that at least one of those results belongs to the same domain as the From address, and tells receivers what to do when none does.
Side by side
| SPF | DKIM | DMARC | |
|---|---|---|---|
| What it checks | Is the connecting IP allowed for the domain | Does a valid signature verify against a DNS key | Does an SPF or DKIM pass align with the From domain |
| Identity used | Envelope sender (MAIL FROM) and HELO name | The d= domain in the signature | The visible From domain |
| Published as | TXT record at the domain | TXT record at selector._domainkey | TXT record at _dmarc |
| Survives forwarding | Often not | Usually, if content is unchanged | Passes if either aligned check survives |
| Gives reports | No | No | Yes, aggregate and failure reports |
What each one does not prove
SPF does not look at the From header a person reads. A message can pass SPF using the attacker's own domain in the envelope while showing yours in From.
DKIM says some domain signed the message. RFC 9989 points out that a message can bear a valid signature from any domain, even one used by a bad actor. A signature alone says nothing about the From domain.
DMARC does not read the message content or judge intent. A criminal can register a lookalike domain and pass all three checks on it. Authentication proves identity of a domain, not honesty.
How they fit together
- The receiver evaluates SPF on the envelope sender.
- It evaluates any DKIM signatures.
- It looks up the DMARC record for the From domain.
- If SPF or DKIM passed and the domain aligns with From, DMARC passes.
- If neither aligned, the policy in the record (none, quarantine or reject) tells the receiver what the domain owner wants.
Receivers may apply their own judgment as well. RFC 9989 says receivers need more analysis than DMARC alone and should not reject solely because of a reject policy.
A practical setup
- Publish SPF for each sending domain, and keep it under 10 lookups.
- Sign all outbound mail with DKIM, using your own domain for every service so it aligns.
- Publish DMARC with rua, then raise the policy in stages. The rollout plan covers the order.
- Add MTA-STS if you want to protect transport encryption.
For a longer walk through setup, see the existing setup guide.
Quick check
If a message passes DMARC, is it safe?
No. It means the From domain was authenticated and aligned. A fraudster using their own domain can pass. Treat DMARC as one signal about who sent the message.
Do I need both SPF and DKIM?
DMARC needs only one aligned pass. Publishing both is stronger, since forwarding breaks SPF and some content changes break DKIM. Gmail and Yahoo require both for bulk senders.
Sources
- RFC 7208, Sender Policy Framework
- RFC 6376, DomainKeys Identified Mail Signatures
- RFC 9989, DMARC
- Google, email sender guidelines
Last reviewed: 19 October 2026.
