SPF, DKIM and DMARC: what each one checks and how they fit together

SPF is a list of the servers you allow to send mail for your domain. DKIM adds a signature to each message, so the receiver (Gmail, Outlook or any other mail server you send to) can check the message arrived unchanged. DMARC is where you tell receivers what to do with mail that fails.

SPF and DKIM each give a pass or a fail. Without DMARC, the receiver writes those results into a header and does nothing else with them. DMARC also adds a rule. The domain that passed SPF or DKIM has to be the domain in the From address the reader sees.

Do I need all three? Yes. Google and Yahoo require all three from bulk senders, and SPF and DKIM break in different places, so having both keeps more of your mail passing.

Setup steps

1. List every service that sends mail with your domain in the From address: your mail platform, your CRM, your invoicing tool, the website's contact form and the newsletter tool. Expect the list to be longer than you first think.
2. Publish one SPF record at your domain that includes each of them. SPF record syntax shows the format, and the record has to stay within ten DNS lookups.
3. Turn on DKIM in each service, set it to sign with your domain, and publish the record it gives you.
4. Publish a DMARC record at p=none with a rua= address. Receivers keep delivering your mail as before, and start sending reports to that address.
5. Read the reports for a few weeks and fix every sender they show failing. Then move to p=quarantine, then p=reject. DMARC setup covers each step in detail.

SPF

SPF is a TXT record at your domain listing the servers you allow to send for it:

When a server connects to deliver a message, the receiver looks at the domain in the return path, the address bounces would go to, and fetches that domain's SPF record. If the connecting IP is in the record, SPF passes. If it isn't, the result is a soft fail when the record ends in ~all, or a hard fail when it ends in -all.

The return path domain often belongs to the sending service. A service usually puts its own domain there so it can collect the bounces. SPF then passes for the service's domain, and that pass does you no good under DMARC.

SPF also breaks on forwarding. When a message is forwarded, the forwarding server's IP is the one connecting, and it isn't in your record.

DKIM

The sending service adds a header to each message with a signature over the body and the important headers. It makes the signature with a private key it holds. The header says which domain signed and which selector to look up:

The receiver fetches the public key from google._domainkey.example.com and checks the signature. If it verifies, DKIM passes for example.com. The IP that delivered the message plays no part, so DKIM still passes after forwarding. Any edit after signing breaks it, such as a mailing list adding a footer or rewriting the subject.

Check the d= tag. Many services sign with their own domain by default, and that pass does you no good under DMARC. Each one has a setting to sign with your domain instead, and gives you a CNAME or TXT record to publish when you turn it on.

DMARC

DMARC is a TXT record at _dmarc under your domain:

The receiver runs SPF and DKIM as above, then the DMARC check. The message passes DMARC if SPF or DKIM passed for a domain that matches the From header. If neither did, the message fails, and the receiver acts on the p= value you set. With none, it delivers the message as normal. With quarantine, it sends the message to spam. With reject, it refuses the message.

The rua= address is where receivers send a daily report of every server that sent as your domain and whether it passed. These reports are the only feedback you get. They're how you find forgotten senders before you set the policy to reject. What is DMARC explains the record in more detail.

Alignment

SPF checks the return path domain. DKIM checks the d= domain. The reader sees the From header domain, and neither SPF nor DKIM looks at it. To pass DMARC, the SPF or DKIM domain has to match the From domain. That match is called alignment.

Say you send a newsletter through a service. The return path is bounces.service.com, so SPF passes for service.com. You turned on DKIM with your domain, so the signature has d=example.com. The From is news@example.com.

Check	Domain it passed for	Matches From?
SPF	service.com	No
DKIM	example.com	Yes
DMARC	Pass, on DKIM

If you turn DKIM off, the same message fails DMARC, even though SPF passed. People are often surprised when SPF and DKIM both pass and DMARC still fails. It happens when both passed for the service's domain instead of yours. DMARC alignment covers the relaxed and strict modes and the subdomain cases.

SPF, DKIM and DMARC compared

	SPF	DKIM	DMARC
Checks	The connecting IP against a list	A signature against a key	Whether either passed for the From domain
Domain used	Return path	d= tag	From header
Breaks on	Forwarding	Edits in transit, mailing lists	Both failing, or neither aligned
On failure	A header note	A header note	Whatever p= says
Reports	None	None	Daily, to rua=

SPF and DKIM fail in different situations, which is why you set up both. With both in place, a forwarded message can still pass on DKIM, and a mailing-list message can sometimes still pass on SPF. To pass DMARC, a message needs only one of them to pass and align.

The Authentication-Results header

Receivers add the results of all three checks to each message they deliver. To see them, open a message you sent to yourself, view the headers, and find the line starting Authentication-Results:

The receiver acted on the dmarc= result on the last line. Compare the domains after smtp.mailfrom and header.i with the domain after header.from to see which check aligned.

Aggregate reports

A header shows one message. The rua= reports show every one: each server that sent as your domain, the SPF and DKIM result for it, whether it aligned, and what the receiver did. In the reports you'll find the invoicing tool you forgot, failing DMARC, before you set p=reject and its mail starts bouncing. We read those reports for you, and our weekly digest lists each sender and its result. On a paid plan, we email you the day an unfamiliar sender first fails. Your first domain is free.