SPF vs DKIM vs DMARC: What Each Does and Why You Need All Three

The Authentication Stack Every Email Sender Needs

If you've ever had emails land in spam or received a fraud report about spoofed emails using your domain, the root cause is almost always a missing or misconfigured email authentication record. SPF, DKIM, and DMARC are the three standards that together form the modern email authentication stack.

What Is SPF?

SPF (Sender Policy Framework) is a DNS TXT record that authorizes specific IP addresses and mail servers to send email on behalf of your domain.

When a receiving mail server gets a message claiming to be from hello@yourdomain.com, it looks up the SPF record at yourdomain.com and checks whether the sending IP address is on the approved list.

Example SPF Record

v=spf1 ip4:203.0.113.10 include:_spf.google.com include:sendgrid.net ~all

Breaking this down:

• v=spf1 — the SPF version tag, required
• ip4:203.0.113.10 — authorizes a single IPv4 address directly
• include:_spf.google.com — includes Google Workspace's approved IPs
• include:sendgrid.net — includes SendGrid's transactional IPs
• ~all — softfail: mark non-matching senders as suspicious but don't reject

The 10-DNS-Lookup Limit

SPF has a critical constraint: the receiving server is only permitted to perform 10 recursive DNS lookups while evaluating your SPF record. Every include:, a:, mx:, and exists: mechanism triggers a lookup. If you use multiple ESPs it is extremely easy to exceed this limit, resulting in SPF PermError.

What SPF Does Not Protect

SPF only validates the envelope from (MAIL FROM). It does not validate the From: header that appears in the user's inbox. This is a critical gap — spammers routinely pass SPF while spoofing the visible From header.

What Is DKIM?

DKIM (DomainKeys Identified Mail) cryptographically signs your outgoing emails using a private key stored on your mail server. The corresponding public key is published as a DNS TXT record.

How the Signature Works

Your mail server adds a header like:

DKIM-Signature: v=1; a=rsa-sha256; d=yourdomain.com; s=mail;
  h=from:to:subject:date:message-id;
  bh=base64encodedBodyHash;
  b=base64encodedSignature

The receiving server fetches the public key from mail._domainkey.yourdomain.com and verifies the signature against the email headers listed in h=.

DKIM DNS Record Format

mail._domainkey.yourdomain.com  IN  TXT
"v=DKIM1; k=rsa; p=MIIBIjANBgkqhkiG9w0BAQEFAAOC..."

What DKIM Protects

• Content integrity: Any modification to signed headers or body will invalidate the signature
• Forwarding resilience: Unlike SPF, DKIM signatures survive email forwarding

What DKIM Does Not Protect

DKIM does not prevent replay attacks, and it doesn't tell receivers what to do when the signature fails. That is DMARC's job.

What Is DMARC?

DMARC (Domain-based Message Authentication, Reporting & Conformance) ties SPF and DKIM together and adds alignment and policy enforcement.

The DMARC DNS Record

_dmarc.yourdomain.com  IN  TXT
"v=DMARC1; p=quarantine; pct=100; rua=mailto:dmarc@yourdomain.com; adkim=s; aspf=r;"

Key tags:

• p= — policy: none (monitor only), quarantine (send to spam), reject (block entirely)
• pct= — percentage of messages the policy applies to
• rua= — aggregate report destination (daily XML reports)
• adkim= — DKIM alignment: r relaxed or s strict
• aspf= — SPF alignment: r relaxed or s strict

What Is Alignment?

DMARC requires that either SPF or DKIM aligns with the From: header domain:

• SPF alignment: the MAIL FROM domain must match the From: header domain
• DKIM alignment: the d= domain in the DKIM signature must match the From: header domain

A message can pass SPF and DKIM and still fail DMARC if neither aligns with the visible From header.

The Rollout Strategy

Never jump straight to p=reject. The recommended sequence:

1. Start with p=none — monitor for 2–4 weeks, analyze aggregate reports
2. Move to p=quarantine; pct=10 — gradually apply quarantine to a small percentage
3. Increase pct — ramp to 100% quarantine while monitoring report data
4. Move to p=reject — full enforcement once all legitimate senders pass consistently

SPF vs DKIM vs DMARC: Side-by-Side

Common Mistakes to Avoid

1. Using +all in SPF

The +all mechanism authorizes any IP to send for your domain. Always end with ~all or -all.

2. Multiple SPF Records

You can only have one SPF TXT record per domain. Two v=spf1 records cause a PermError.

3. Setting DMARC to p=reject Without Testing

Jumping to p=reject will block legitimate email from sources you forgot to authenticate. Always start with p=none.

4. Using a 1024-bit DKIM Key

RSA-1024 is considered weak. Use 2048-bit minimum and rotate annually.

Tools to Audit Your Setup

• FreeMailTools SPF Checker — validates lookup count and includes
• FreeMailTools DKIM Generator — generates 2048-bit RSA keypairs
• FreeMailTools DMARC Checker — inspects all DMARC tags and alignment
• MXToolbox SuperTool — useful secondary DNS verification
• Mail-Tester — end-to-end test confirming all three pass on a real email