SPF, DKIM and DMARC explained
SPF, DKIM and DMARC are often grouped together, but they solve different problems. SPF checks sending infrastructure, DKIM verifies a cryptographic signature, and DMARC connects those results to the domain the recipient can actually see.
SPF: is this server allowed to send?
SPF is a DNS TXT policy published by a domain. It describes which IP addresses or systems are allowed to send mail for the envelope sender domain. Receivers compare the connecting server with that policy.
SPF is useful, but forwarding can break the relationship between the original sender and the server that finally delivers the message. SPF also does not, by itself, guarantee that the visible From address belongs to the domain that passed SPF.
DKIM: was this message signed by the domain?
DKIM adds a cryptographic signature to the message headers. The signature contains a signing domain and a selector. The receiver uses those values to find a public key at selector._domainkey.domain and checks that the signed parts of the message have not been altered.
Selectors let a domain publish multiple keys at the same time, which is useful for different mail providers and key rotation. A DKIM pass means the signature validated; it does not automatically mean the visible From domain is aligned.
DMARC: does authentication align with the visible From domain?
DMARC evaluates SPF and DKIM in relation to the domain in the visible From header. A message can satisfy DMARC when at least one aligned authentication path passes: aligned SPF or aligned DKIM.
The DMARC record can also tell receivers what to do with failing mail using policies such as none, quarantine or reject, and it can publish addresses for aggregate reports.
Inspect all three layers
Use the individual checkers to see the exact records a domain publishes. If you have a real received message, the Email Header Analyzer can show the authentication results that were recorded during delivery.
What alignment actually means
Suppose the visible From address is user@example.com. SPF might pass for a return-path under a mail provider's domain, and DKIM might validate for another domain. DMARC asks whether the domain that passed is sufficiently related to example.com according to the configured alignment mode.
This is why a message can show SPF=pass and still fail DMARC. The SPF result may be valid but not aligned with the visible From domain. The same principle applies to DKIM.
A useful troubleshooting order
- Start with the received message. Authentication-Results and DKIM-Signature show what was actually evaluated.
- Check SPF. Confirm the sending platform is included and watch the DNS-lookup limit.
- Check DKIM. Use the selector from the signature and confirm a non-empty public key is published.
- Check DMARC. Review policy, SPF alignment, DKIM alignment and report destinations.
- Check mail routing if needed. MX records tell you where inbound mail is supposed to go; they are separate from sender authentication.
Prefer the command line?
Check a live DMARC policy after reading the authentication overview.
> dmarc example.com
Run in Terminal ->