SPF vs DKIM vs DMARC: Email Authentication Explained

The Email Spoofing Problem

SMTP, the protocol that transfers email between servers, was designed in 1982 without any authentication mechanism. Any server can claim to send mail from any address. This allows attackers to forge the From: header and impersonate your domain in phishing campaigns.

SPF, DKIM, and DMARC are three DNS-based standards that together make spoofing significantly harder. Each addresses a different attack surface.

SPF — Sender Policy Framework

SPF (RFC 7208) lets you publish a list of IP addresses and hostnames authorized to send email on behalf of your domain. Receiving mail servers check the SPF record at the time of delivery.

How it works

1. You publish a TXT record at your domain listing authorized senders.
2. When a receiving server gets a message claiming to be from your domain, it looks up your SPF record.
3. If the sending server's IP is in the list, SPF passes. If not, it fails.

# Example SPF record
v=spf1 include:_spf.google.com include:sendgrid.net ip4:203.0.113.5 ~all

# Mechanism explanations:
# include:_spf.google.com  — authorize Google Workspace
# ip4:203.0.113.5          — authorize a specific IP
# ~all                     — softfail for everything else

SPF limitations

SPF only checks the envelope sender (MAIL FROM), not the visible From: header that users see. It also breaks when email is forwarded, because the forwarding server's IP won't be in your SPF record.

DKIM — DomainKeys Identified Mail

DKIM (RFC 6376) adds a cryptographic signature to outgoing messages. The signing server attaches a DKIM-Signature header containing a hash of the message body and selected headers, signed with a private key. The corresponding public key is published as a DNS TXT record.

How it works

1. Your mail server signs outgoing messages with a private key.
2. Receiving servers retrieve your public key from DNS to verify the signature.
3. If the message was altered in transit, signature verification fails.

# DKIM public key DNS record
selector._domainkey.example.com. IN TXT
  "v=DKIM1; k=rsa; p=MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQ..."

# DKIM-Signature header in outgoing email
DKIM-Signature: v=1; a=rsa-sha256; d=example.com; s=selector;
  h=from:to:subject:date; bh=base64hash; b=signature

DKIM survives forwarding because the signature travels with the message. It validates that the content hasn't changed, but it doesn't prevent domain display name spoofing on its own.

DMARC — Policy and Reporting

DMARC (RFC 7489) builds on SPF and DKIM by adding an alignment check and a policy that tells receiving servers what to do when checks fail.

Alignment

DMARC requires that the domain in either the SPF MAIL FROM or the DKIM d= tag aligns with the From: header domain. This closes the gap that SPF alone leaves open.

# DMARC record
_dmarc.example.com. IN TXT
  "v=DMARC1; p=quarantine; rua=mailto:dmarc@example.com;
   ruf=mailto:forensic@example.com; pct=100; adkim=r; aspf=r"

# Policy values:
# p=none       — monitor only, take no action
# p=quarantine — deliver to spam folder
# p=reject     — reject the message entirely

Reports

DMARC sends aggregate reports (RUA) and forensic reports (RUF) to the email addresses you specify. Aggregate reports are XML files showing which sources passed and failed authentication for your domain. Start with p=none and analyze reports before enforcing stricter policies.

How They Work Together

A message passes DMARC if at least one of these is true:

• SPF passes and the SPF MAIL FROM domain aligns with the From domain.
• DKIM passes and the DKIM d= value aligns with the From domain.

Using both SPF and DKIM gives you redundancy — if SPF fails (e.g., forwarded message), DKIM can still authenticate the message.

Deployment Order

Deploy in this order to avoid disrupting legitimate mail:

1. SPF — add the TXT record for your domain. Use ~all (softfail) initially.
2. DKIM — generate a key pair, configure your mail server to sign, publish the public key in DNS.
3. DMARC p=none — enable reporting without enforcement. Monitor for 2–4 weeks.
4. DMARC p=quarantine — enforce for confirmed sources after reviewing reports.
5. DMARC p=reject — full enforcement once all legitimate sources pass.

Frequently Asked Questions

Do I need all three?

For meaningful protection, yes. SPF alone doesn't prevent display-name spoofing. DKIM alone has no policy enforcement. DMARC alone does nothing without SPF or DKIM to check. The three standards are designed to be layered.

What is the SPF DNS lookup limit?

SPF allows a maximum of 10 DNS lookups per evaluation. Each include:, a, and mx mechanism counts toward this limit. Exceeding it causes a PermError, which is treated as a failure. Use flattening tools if you're approaching the limit.

What is BIMI?

Brand Indicators for Message Identification (BIMI) displays your brand logo in supporting email clients (Gmail, Yahoo) next to authenticated messages. It requires a valid DMARC policy of p=quarantine or p=reject.