SPF vs DKIM vs DMARC: What Each One Actually Does

SPF, DKIM, and DMARC get mentioned together so often that it's easy to assume they do roughly the same thing. They don't — each one solves a different, specific problem, and email authentication only actually works when all three are in place and aligned.

SPF: which servers are allowed to send

SPF (Sender Policy Framework) is a DNS TXT record that publicly lists which mail servers are authorized to send email on behalf of your domain. When a receiving server gets a message claiming to be from your domain, it checks the sending server's IP against your published SPF record. If the sending IP isn't on the list, the message fails SPF.

SPF's limitation is that it only validates the sending server, not the message content — and it breaks easily when mail is forwarded, since the forwarding server's IP usually isn't in the original domain's SPF record.

DKIM: proving the message wasn't altered

DKIM (DomainKeys Identified Mail) takes a different approach: it cryptographically signs outgoing mail using a private key, and publishes the corresponding public key in DNS under a specific selector. Receiving servers fetch that public key and verify the signature — confirming both that the message really came from a server holding your private key, and that its content wasn't tampered with in transit.

Unlike SPF, DKIM survives most forwarding, since the signature travels with the message content rather than depending on which server relayed it.

DMARC: the enforcement layer

SPF and DKIM can each individually pass or fail, but neither one, by itself, tells a receiving server what to actually do about a failure. That's DMARC's job. A DMARC record specifies a policy — none, quarantine, or reject — that instructs receivers how to handle mail that fails SPF and DKIM alignment, plus where to send aggregate reports about authentication results across all your mail traffic.

DMARC also requires alignment, not just a pass: the domain in the visible "From" header has to match (or be a subdomain of) the domain that passed SPF or DKIM. This closes a spoofing loophole where an attacker could pass SPF using their own domain's servers while forging your domain in the From address.

Why you need all three

SPF without DMARC means failures are detected but nothing happens about them. DKIM without SPF means you're only protected against tampering, not against a spoofed sender using a different, unauthorized server entirely. DMARC without SPF or DKIM configured has nothing to enforce a policy against. The three are designed to work as a set — running an Email Health check evaluates all three together for exactly this reason.