SPF vs DKIM vs DMARC — What's the Difference and Do You Need All Three?

The Three Pillars of Email Authentication

If you manage a domain that sends email, you've probably seen SPF, DKIM, and DMARC mentioned together. They're often treated as a bundle, but each does something distinct. Understanding the difference is critical to implementing them correctly.

Here's the short version:

SPF — Who Can Send

SPF (Sender Policy Framework) answers the question: Is this mail server allowed to send email from this domain?

When a receiving mail server gets a message from noreply@yourdomain.com, it checks the DNS for your domain's SPF record. The SPF record lists authorized sending IPs and services. If the actual sending server's IP is on the list, SPF passes.

What SPF doesn't do

SPF only checks the envelope sender (the SMTP MAIL FROM address), not the visible From: header that you see in your email client. A spammer can set a legitimate envelope sender while using a spoofed From: header — which is where DKIM and DMARC come in.

DKIM — Cryptographic Proof of Identity

DKIM (DomainKeys Identified Mail) answers the question: Was this message actually sent by the domain in the From header, and has it been tampered with in transit?

DKIM works by:

1. Your mail server generates an RSA keypair (private + public)
2. The public key is published as a DNS TXT record at selector._domainkey.yourdomain.com
3. For each outgoing message, your mail server signs specific headers (From, Subject, Date, To) and the message body using the private key
4. The signature is added to the message as a DKIM-Signature header
5. The receiving server retrieves your public key from DNS and verifies the signature

If the signature is valid, it proves:

• The message originated from your domain (or was authorized by your domain)
• The signed headers and body haven't been altered in transit

What DKIM doesn't do

DKIM doesn't prevent email from being sent by unauthorized servers — it just proves signatures from authorized senders are valid. Someone without your private key cannot forge a valid DKIM signature.

DMARC — Policy, Alignment, and Reporting

DMARC (Domain-based Message Authentication, Reporting & Conformance) answers the question: What should receiving servers do with messages that fail SPF and/or DKIM? And report back what you see.

DMARC adds three critical capabilities:

1. Alignment

DMARC requires that the domain in the visible From: header matches (aligns with) the domain that passes SPF or DKIM. This closes the spoofing gap that SPF alone leaves open.

Without DMARC alignment, a spammer can:

• Set the envelope sender to their legitimate domain (SPF passes)
• Put your domain in the From: header (which is what users see)

DMARC alignment requires that at least one of SPF or DKIM must pass and align with the From header domain.

2. Policy

DMARC tells receiving servers what to do with messages that fail alignment:

• p=none — Monitor only, deliver normally
• p=quarantine — Send to spam
• p=reject — Reject completely

3. Reporting

DMARC generates daily aggregate reports (XML files) showing who is sending email from your domain and whether messages are passing authentication. This is invaluable for auditing your email infrastructure.

How They Work Together

Think of them as layers of defense:

Incoming Email
    ↓
1. SPF Check: Is the sending server authorized?
    ↓
2. DKIM Check: Is the message signature valid?
    ↓
3. DMARC Check: Do the authenticated domains align with From? 
                 What policy applies? Send report.
    ↓
4. Receiving server's decision

A message passes DMARC if either SPF or DKIM passes and the passing domain aligns with the From header.

Do You Need All Three?

Yes, for complete protection.

• SPF alone — Easily bypassed because it doesn't check the From header
• DKIM alone — Provides signing but no policy enforcement
• SPF + DKIM, no DMARC — Authentication passes but there's no policy for failures, no alignment requirement, and no reporting
• All three — Closes all known email spoofing attack vectors, provides a consistent rejection policy, and gives you visibility into your domain's email activity

Checking SPF, DKIM, and DMARC

Use our combined checker tools:

• SPF Checker — Validate SPF record, check lookup count
• DKIM Checker — Verify DKIM signatures and key sizes
• DMARC Checker — Analyze DMARC policy and alignment settings
• Authentication Score — Combined SPF/DKIM/DMARC health score

Or check all three at once for any domain using our Domain Health Checker.