Home / Guides
SPF vs DKIM vs DMARC
Three DNS records, three different jobs. Here is what each one proves, and why you need all of them.
The short version
| Record | What it proves | Where | Spec |
|---|---|---|---|
| SPF | Which servers may send mail using your domain in the envelope (Return-Path) | TXT at the domain | RFC 7208 |
| DKIM | That the message was signed by the domain in d= and not changed in transit | TXT at selector._domainkey | RFC 6376 |
| DMARC | That SPF or DKIM passed for a domain matching the visible From address, and what to do if not | TXT at _dmarc | RFC 7489 |
SPF: authorised servers
An SPF record lists the IP addresses and services allowed to send mail for a domain, for example v=spf1 include:_spf.google.com ~all. The receiving server checks the connecting IP against the record for the envelope sender (MAIL FROM / Return-Path) domain, not the From header the recipient sees.
Limits to know: one SPF record per domain, at most 10 DNS-querying terms (include, a, mx, ptr, exists, redirect) including nested ones, and SPF usually breaks when mail is forwarded, because the forwarding server's IP is not in your record.
DKIM: a signature on the message
DKIM adds a DKIM-Signature header signed with a private key. The receiver fetches the public key from selector._domainkey.domain (selector from s=, domain from d=) and verifies that the signed headers and body are unchanged. DKIM survives plain forwarding, but can break when a mailing list modifies the subject or body.
DMARC: alignment and policy
SPF and DKIM on their own do not protect the From address people see. A spammer can pass SPF for their own domain while putting yours in From. DMARC closes the gap: a message passes DMARC only if
- SPF passes and the Return-Path domain aligns with the From domain, or
- DKIM passes and the d= domain aligns with the From domain.
"Aligned" means the same organisational domain under relaxed alignment (the default), or the exact same domain under strict. The DMARC record then tells receivers what to do with failures (p=none, quarantine or reject) and where to send aggregate reports (rua=).
Do I need all three?
Yes. Google and Yahoo require SPF, DKIM and DMARC for bulk senders, and DMARC cannot be enforced safely without at least one of SPF or DKIM aligned on every legitimate source. DKIM is the more reliable of the two because it survives forwarding, so make sure every sending service signs with your domain.
Setup order
- Inventory everything that sends as your domain: mailbox provider, marketing platform, CRM, help desk, billing, transactional email.
- Publish one SPF record covering them (SPF generator).
- Enable DKIM in each service with your own domain, and confirm with the DKIM checker.
- Publish DMARC at
p=nonewith aruaaddress (DMARC generator). - Review reports, fix unaligned sources, then move to quarantine and reject.
Frequently asked questions
Does DMARC need both SPF and DKIM to pass?
No. One aligned pass is enough: SPF aligned or DKIM aligned.
Which is more important, SPF or DKIM?
Both matter, but DKIM is more robust for DMARC because it survives forwarding, while SPF usually fails when mail is forwarded.
Related tools
Domain health check
All records, one score
Open tool →SPF checker
Lookups, includes, syntax
Open tool →DKIM checker
Keys by selector
Open tool →DMARC checker
Policy, reporting, alignment
Open tool →Get alerted when it changes
Free daily monitoring re-checks SPF, DKIM, DMARC, MX, BIMI and MTA-STS and emails you when something changes or fails.
Set up free monitoring