SPF, DKIM, and DMARC: What Each Record Checks

SPF, DKIM, and DMARC get talked about as a single setup step, but each one checks something different, and mailbox providers weight them differently when deciding whether your mail is trustworthy.

SPF: who's allowed to send

SPF (Sender Policy Framework) is a DNS record that lists which mail servers are allowed to send on behalf of your domain. When a receiving server gets a message, it checks the sending IP against that list. It's the easiest of the three to set up, and also the easiest to get wrong — one missing IP after you switch providers, and legitimate mail starts failing the check.

DKIM: proving the message wasn't altered

DKIM (DomainKeys Identified Mail) attaches a cryptographic signature to each outgoing message, generated from a private key only your sending server holds. The receiving server looks up your public key in DNS and verifies the signature matches. Unlike SPF, DKIM survives forwarding — the signature travels with the message rather than depending on which server relayed it.

DMARC: making the other two enforceable

DMARC (Domain-based Message Authentication, Reporting and Conformance) doesn't check the message itself — it tells receiving servers what to do when SPF or DKIM fail, and asks for a report when that happens. A DMARC policy of 'reject' is what actually stops someone from spoofing your domain; without it, SPF and DKIM are just informational.

In practice: SPF alone stops naive spoofing, DKIM proves the message wasn't altered in transit, and DMARC is what makes both of them enforceable instead of advisory. All three configured and passing is table stakes for inbox placement on Gmail, Outlook, and Yahoo today.