SPF, DKIM and DMARC Explained

SPF: authorize sending infrastructure

Sender Policy Framework, or SPF, publishes which infrastructure may send mail for the envelope-sender domain. It does not authenticate the human author. Inventory the mailbox provider, website notifications and marketing services before editing records. An SPF failure can affect delivery, but the result must be interpreted alongside DKIM, DMARC and receiver policy.

DKIM: verify a domain signature

DomainKeys Identified Mail, or DKIM, adds a cryptographic signature that a receiver checks using the signing domain's public key. It verifies the signed parts of a message, not the trustworthiness of its content or sender. Configure the service's selector and inspect a real message. Finding a key in DNS does not prove that the sending service is signing correctly.

DMARC: check alignment with the visible From domain

DMARC passes when at least one successful SPF or DKIM result aligns with the visible From domain. A published policy requests handling for failures and can support reporting; receivers apply their own policies. Google requires SPF or DKIM for all senders to personal Gmail and both, plus DMARC, for bulk senders above its published threshold. Authentication alone does not guarantee inbox delivery.

Read authentication as separate results

SPF checks an envelope-sender domain authorization; DKIM verifies a domain signature. DMARC requires a successful aligned SPF or DKIM result relative to the visible From domain. Authentication success does not demonstrate that a message is harmless or guarantee inbox placement.

1. Inventory mailbox, website, CRM and marketing senders.
2. Collect a representative header from each.
3. Compare authentication and alignment results.
4. Review legitimate senders before stronger policy.

Authentication results and alignment decisions

RFC 9989, published May 2026, supersedes RFCs 7489 and 9091. Receiver handling and reporting are separate considerations; preserve distinctions between standard behavior and provider requirements. Gmail requirements differ for general and bulk senders. Do not copy a strict policy before identifying legitimate senders.

Example: SPF passes for an unrelated domain

A provider authenticates its own domain while the business uses a different visible From. A passing SPF line alone cannot establish alignment. The inventory records system, owner, sending domain, signing domain and observed result. This is an illustrative scenario, not a customer case or a promised result.

A simple example of domain alignment

Suppose a store sends receipts through a separate mail provider. Adding that provider to SPF is not enough if the authenticated domain does not align with the visible From domain. An aligned DKIM signature can provide the other route to a DMARC pass. Inspect a real message from each sender; a DNS lookup alone cannot verify its signature.