What Are SPF, DKIM, and DMARC?
What Are SPF, DKIM, and DMARC?
SPF, DKIM, and DMARC are three email authentication standards that work together to fight email spoofing and improve email security and deliverability. They let domain owners prove that email claiming to come from their domain is legitimate, and let receiving mail servers detect and reject forged messages. For anyone who owns a domain or sends email, understanding these three is valuable — they are essential to protecting a domain from being spoofed and to ensuring legitimate email reaches inboxes. This guide explains what each does and how they work together, in plain terms.
The Problem They Solve
These standards exist to address email's spoofing weakness:
Email lacks built-in verification: The basic email system does not strongly verify senders, so attackers can spoof (forge) sender addresses, enabling phishing and scams.
The goal: SPF, DKIM, and DMARC add layers of verification so that receiving servers can check whether email claiming to be from a domain is actually authorized and authentic — combating spoofing.
Two benefits: Beyond fighting spoofing, proper email authentication improves deliverability — authenticated email is more likely to reach inboxes rather than spam.
SPF (Sender Policy Framework)
SPF addresses which servers can send for a domain:
What it does: SPF lets a domain owner publish a list of mail servers authorized to send email for the domain (as a DNS record).
How it works: When a receiving server gets an email claiming to be from the domain, it checks the SPF record to see if the sending server is authorized. If not, the email fails SPF.
What it covers: SPF verifies the sending server against the authorized list, helping detect email sent from unauthorized servers.
Its limit: SPF alone has limitations (e.g., it checks the sending server but does not protect the visible "From" address directly, and can break when email is forwarded), which is why DKIM and DMARC complement it.
DKIM (DomainKeys Identified Mail)
DKIM adds a cryptographic signature:
What it does: DKIM adds a digital signature to outgoing emails, using cryptographic keys. The domain publishes a public key (in DNS), and signs emails with the corresponding private key.
How it works: The receiving server uses the published public key to verify the signature, confirming the email genuinely came from the domain and was not altered in transit.
What it covers: DKIM provides authenticity (the email is from the domain) and integrity (it was not tampered with).
Its strength: Because it is cryptographic and tied to the message, DKIM survives some scenarios (like forwarding) better than SPF, and verifies the message's authenticity.
DMARC (Domain-based Message Authentication, Reporting and Conformance)
DMARC ties it together and adds policy and reporting:
What it does: DMARC builds on SPF and DKIM, letting a domain owner specify a policy for how receiving servers should handle email that fails authentication, and providing reporting.
How it works: DMARC checks that an email passes SPF and/or DKIM and that these align with the visible "From" domain. The domain's DMARC policy then tells receivers what to do with failing email — monitor, quarantine (spam folder), or reject.
What it covers: DMARC protects the visible "From" address (which SPF and DKIM alone do not fully address), instructs receivers on handling failures, and provides reports showing who is sending email claiming to be from your domain — valuable for spotting spoofing and misconfigurations.
Policies: DMARC policies range from "none" (monitor only) to "quarantine" to "reject." Domain owners often start with monitoring and progress to stricter policies as they confirm legitimate email passes.
How They Work Together
The three standards complement each other:
Layered authentication: SPF checks the sending server, DKIM verifies the message's authenticity and integrity, and DMARC ties them to the visible "From" address with a policy and reporting.
Stronger together: Used together, they provide robust protection against spoofing of a domain — far stronger than any one alone.
For domain owners: Properly configuring all three protects your domain from being spoofed, protects your recipients from forged email, and improves your legitimate email's deliverability.
Frequently Asked Questions
What do SPF, DKIM, and DMARC do?
They are three email authentication standards that fight spoofing and improve deliverability. SPF lets a domain specify which mail servers are authorized to send email for it, so receivers can check the sending server. DKIM adds a cryptographic signature so receivers can verify an email genuinely came from the domain and was not altered. DMARC builds on both, protecting the visible "From" address, specifying a policy for handling failing email (monitor, quarantine, or reject), and providing reports. Together they let domains prove their email is legitimate and help receivers reject forgeries.
How do SPF, DKIM, and DMARC work together?
They form layered authentication. SPF checks whether the sending server is authorized for the domain. DKIM cryptographically verifies the message's authenticity and integrity. DMARC ties SPF and DKIM results to the visible "From" address, tells receiving servers how to handle email that fails (monitor, quarantine, or reject), and provides reporting on who is sending email claiming to be from your domain. Used together, they provide robust protection against domain spoofing — far stronger than any one alone — and improve legitimate email deliverability.
Do I need SPF, DKIM, and DMARC for my domain?
If you own a domain that sends email (or even one that does not, to prevent it being spoofed), configuring all three is highly valuable. They protect your domain from being spoofed by attackers, protect your recipients from forged email appearing to come from you, and improve your legitimate email's deliverability (authenticated email is more likely to reach inboxes). Domain owners often start DMARC in monitoring mode and progress to stricter policies (quarantine, reject) after confirming legitimate email passes. Together they are essential modern email security for any domain.
Conclusion
SPF, DKIM, and DMARC are three email authentication standards that work together to fight email spoofing and improve deliverability, addressing the basic email system's lack of strong sender verification. SPF lets a domain specify which mail servers are authorized to send for it, so receivers can check the sending server. DKIM adds a cryptographic signature so receivers can verify an email genuinely came from the domain and was not altered, providing authenticity and integrity. DMARC builds on both, protecting the visible "From" address, specifying how receivers should handle failing email (monitor, quarantine, or reject), and providing valuable reporting on who is sending email claiming to be from your domain. Used together as layered authentication, they provide robust protection against domain spoofing — far stronger than any one alone — while improving legitimate email's deliverability. For any domain owner, properly configuring all three protects the domain from being spoofed, protects recipients from forged email, and helps ensure legitimate messages reach inboxes. By understanding what each does and how they complement each other, you can appreciate why these three standards are essential to modern email security.