SPF vs DKIM vs DMARC
What SPF, DKIM and DMARC Each Check
SPF DKIM DMARC is a trio of email authentication standards that help receiving mail servers confirm that a message really comes from the domain it appears to come from. Each standard checks something different, and DMARC ties the other two together.
Email was not designed with a built-in way to verify the sender. Anyone can type any name into the From field, so these standards were added later. The domain owner publishes them as DNS records (entries in the Domain Name System, which holds information such as IP addresses and text for each domain), and receiving servers look them up when a message arrives.
How SPF and DKIM Check Different Parts of a Message
SPF (Sender Policy Framework) publishes a list of the servers allowed to send mail for a domain. The receiver checks whether the connecting server's IP address is on that list. SPF looks at the envelope sender, the address used during delivery, which is often different from the address the reader sees.
DKIM (DomainKeys Identified Mail) works differently. The sending server signs parts of each message with a private key, and the matching public key is published in DNS. The receiver uses that public key to verify the signature, which shows the message was signed by a key the domain controls and was not changed on the way.
The two checks have different weak points. SPF breaks when a message is forwarded, because the forwarding server is not on the original list. DKIM usually survives forwarding, but it breaks if a mailing list or other system changes the signed content. Because the checks fail in different situations, using both gives better coverage. Each has its own article: how SPF records work and how DKIM signing works.
Why DMARC Requires Alignment and Enforcement
DMARC (Domain-based Message Authentication, Reporting and Conformance) is a policy published in DNS. It tells receivers what to do with mail that fails authentication and where to send reports. Its key idea is alignment. A pass from SPF or DKIM is not enough on its own: the domain that passed must match the domain in the visible From address.
Without alignment, a message could pass SPF for a domain the sender controls while showing a different name in the From field. DMARC closes that gap. A message passes DMARC when SPF or DKIM passes and the authenticated domain aligns with the From domain.
The policy has three settings. p=none only collects reports and changes nothing. p=quarantine asks receivers to treat failing mail as suspicious, often by moving it to spam. p=reject asks them to refuse it. Most domain owners begin with monitoring and move toward enforcement once their legitimate mail passes all checks.
A Forwarded Message That Fails Both Checks
Consider a company that sends mail from example.com, a domain reserved for documentation. Its mail server is on the SPF list, and its messages carry a valid DKIM signature. Both checks align with the From address, so DMARC passes.
Now a customer forwards one of these messages to a mailing list. The list's server sends the copy, and that server is not on the company's SPF list, so SPF fails. The list also adds a footer to the body, which changes the signed content, so DKIM fails too. With neither check aligned and passing, DMARC fails. DMARC reports are how the company would notice that legitimate mail is being rejected or filtered in cases like this.
Frequently asked questions
Is SPF enough to stop email spoofing?
No. SPF checks the envelope sender and says nothing about the From address a reader sees, so a forger can pass SPF using their own domain. DMARC with alignment closes that gap by requiring the authenticated domain to match the visible sender. For how forged From addresses work, see email spoofing.
Does DKIM replace SPF, or do I need both?
DKIM does not replace SPF, and the reverse is also true. SPF authorizes sending servers, while DKIM proves that the signed content was not altered. Each one fails in different situations, such as forwarding, so using both gives more coverage. DMARC then requires that at least one of them aligns with the visible From domain.