SPF, DKIM, DMARC: the difference in plain language
Three acronyms, one goal: proving your mail is genuine. What SPF, DKIM and DMARC each check, why none is enough alone and in which order to set them up.
Email was designed in the 1980s without any sender verification: any server may claim to send in your name. SPF, DKIM and DMARC retrofit exactly that verification — each answers a different question, and only the three together form a lock that holds.
SPF: who is allowed to send?
SPF is a list in your domain's DNS: these servers may send on my behalf. The recipient compares the server actually delivering the mail against the list. Strength: easy to set up. Weaknesses: it only checks the technical envelope sender (which the reader never sees) and breaks on forwarding, because then an unknown server is the one delivering.
DKIM: is the mail genuine and unchanged?
DKIM is a cryptographic signature on every mail. The recipient verifies it with the public key from your DNS: if the signature is valid, the mail came from an authorised system and was not altered in transit. Strength: survives forwarding. Weakness: on its own, DKIM says nothing yet about the VISIBLE sender address either.
DMARC: does everything match the visible address — and what to do if not?
DMARC closes the gap left by the other two: it requires SPF or DKIM to match the sender address the recipient sees in the mailbox ("alignment"). And it defines what happens to mail that fails: observe (p=none), send to spam (p=quarantine) or reject (p=reject). On top of that come reports on who is sending in your name, anywhere. Without DMARC, SPF and DKIM are mere hints — with DMARC they become an enforceable rule.
How they work together, by example
A fraudster sends an invoice with your domain as the sender. SPF: his server is not in your list — fail. DKIM: he cannot sign with your key — fail. DMARC with p=reject: the mail is rejected before it reaches a mailbox. Without DMARC, despite both failures, what happens is possibly — nothing.
The right order
- 1. Set SPF — all sending services in one TXT record.
- 2. Enable DKIM per sending service — each one signs with your domain.
- 3. Switch on DMARC with p=none and a reporting address, read the reports.
- 4. Only once your own mail passes cleanly: tighten via quarantine to reject.
Frequently asked questions
Are SPF and DKIM enough without DMARC?
No. Without DMARC there is no link to the visible sender address and no instruction to reject forgeries. Besides, Google and Yahoo explicitly require DMARC for bulk sending.
In which order does the recipient check?
Practically in parallel: SPF against the delivering server, DKIM against the signature, then DMARC evaluates both results including alignment and applies your policy.