DMARC vs. SPF vs. DKIM: The Complete Beginner’s Guide

The three pillars of email security

When the Simple Mail Transfer Protocol (SMTP) was designed in 1982, it lacked any form of identity verification. Anyone could connect to a mail server and send an email claiming to be from ceo@whitehouse.gov or security@paypal.com.

To combat domain impersonation, wire fraud, and phishing, the internet developed three complementary email authentication standards:

[ Outgoing Email ]
        │
        ├──► 1. SPF Check   ──► (Is the sender server IP authorized in DNS?)
        └──► 2. DKIM Check  ──► (Is the cryptographic signature valid & untampered?)
                  │
                  ▼
[ 3. DMARC Policy Evaluation ] ──► (Do SPF or DKIM align with the visible From address?)
                  │
                  ├──► PASS  ──► Delivered to Primary Inbox
                  └──► FAIL  ──► Handled by DMARC policy (none, quarantine, or reject)

These three standards do not compete with one another. Instead, they form a three-legged stool: each handles a distinct phase of authentication, and DMARC binds them together.

What is SPF and how does it work?

SPF (Sender Policy Framework) answers the question: Is this sending mail server IP authorized to send email on behalf of this domain?

• How it works: You publish a DNS TXT record on your domain listing the approved IP addresses and third-party services (such as Google Workspace, Microsoft 365, or SendGrid) allowed to send mail.
• Example record:

  v=spf1 include:_spf.google.com include:sendgrid.net -all
  

• The limitation: SPF only checks the invisible technical envelope sender (Return-Path), not the visible From: header that human recipients read. An attacker can pass SPF on their own server while spoofing your company in the visible header.

Audit your SPF record with our SPF Record Validator.

What is DKIM and how does it work?

DKIM (DomainKeys Identified Mail) answers the question: Did this email genuinely originate from the sender domain, and was the content altered in transit?

• How it works: Your mail server generates an asymmetric cryptographic key pair. The private key adds an encrypted signature (DKIM-Signature:) to the header of every outbound email. You publish the public key in your DNS as a TXT or CNAME record under a "selector" (e.g. google._domainkey.yourdomain.com).
• The verification: When the receiving server fetches the email, it queries your public key from DNS and verifies the signature. If a single character in the body or subject was tampered with by a malicious middleman, the signature fails.
• The limitation: Like SPF, DKIM does not specify what the receiving mail server should do if an unsigned or forged email arrives claiming to be from your domain.

What is DMARC and why it is the master orchestrator

DMARC (Domain-based Message Authentication, Reporting, and Conformance) is the master policy layer that ties SPF and DKIM together.

DMARC introduces two vital superpowers:

1. Identifier Alignment

DMARC mandates that the domain in the visible From: header matches the domain authenticated by SPF or DKIM. If an attacker sends an email showing From: billing@yourdomain.com, DMARC checks whether SPF or DKIM verified yourdomain.com specifically—neutralizing look-alike envelope spoofing.

2. Enforcement Policies

DMARC tells receiving mailbox providers (Gmail, Outlook, Yahoo) exactly what to do when an email fails authentication:

• p=none: Monitor only. Deliver normally and send aggregate XML reports.
• p=quarantine: Route unauthenticated emails directly into spam/junk folders.
• p=reject: Completely drop and bounce fake emails at the network boundary.

Audit your DMARC policy with our DMARC Record Checker.

DMARC, SPF, and DKIM comparison cheat sheet

| Feature | SPF | DKIM | DMARC | | :--- | :--- | :--- | :--- | | Primary Purpose | Whitelists sending IP addresses. | Cryptographically signs email content. | Enforces alignment & dictates failure policies. | | DNS Record Type | TXT at domain root | TXT / CNAME at selector subdomain | TXT at _dmarc subdomain | | Protects Against | Unauthorized server IPs sending mail. | In-transit tampering & forged origins. | Domain impersonation, phishing & spoofing. | | Reporting / Telemetry | No built-in reporting. | No reporting. | Yes (Daily XML aggregate reports via rua=). | | Survival Across Forwarding| Fails when an email is forwarded. | Survives forwarding untouched. | Relies on DKIM to pass forwarded mail. |

How to audit your entire email stack in minutes

To achieve enterprise deliverability and satisfy Google and Yahoo bulk sender requirements:

1. Verify your SPF TXT record does not exceed the RFC 10-lookup limit using our SPF Validator.
2. Verify your DMARC policy is configured with an active reporting address using our DMARC Checker.
3. Verify MX record redundancy using our DNS Lookup Checker.
4. Inspect your sending IP reputation against Spamhaus and Barracuda blacklists using our Spam Blacklist (RBL) Checker.