How does DKIM work with DMARC to stop email spoofing?

DKIM works with DMARC by providing a cryptographic signature that DMARC can verify against the sending domain. When DKIM passes and the signing domain aligns with the domain in the email’s From header, DMARC counts that as a pass. Together, they create a layered defense that makes it significantly harder for attackers to impersonate your domain.

Neither protocol alone is enough. DKIM proves a message was signed with a legitimate key, but without DMARC, there is no policy telling receiving servers what to do when that check fails. DMARC ties everything together by enforcing rules based on the results of DKIM and SPF checks. The sections below walk through exactly how that relationship works, where it can break down, and how to confirm it is functioning correctly.

What happens when DKIM and DMARC check the same email?

When an email arrives, the receiving server runs DKIM and DMARC checks in sequence. DKIM verifies the cryptographic signature in the message header against a public key published in DNS. DMARC then evaluates that result and checks whether the signing domain aligns with the domain in the From address before deciding whether the message passes, fails, or is treated as suspicious.

The two checks are separate but dependent. DKIM operates at the message level, confirming the email has not been tampered with in transit and that a specific domain vouches for it. DMARC operates at the policy level, using the DKIM result as one of its two possible authentication signals.

If DKIM passes and alignment is confirmed, DMARC passes. If DKIM fails or alignment cannot be established, DMARC falls back to the SPF result. Only if both DKIM and SPF fail does DMARC apply its policy, which could mean quarantining or rejecting the message entirely.

What is DKIM alignment and why does it matter for DMARC?

DKIM alignment is the requirement that the domain in the DKIM signature’s d= tag matches the domain in the email’s From header. DMARC does not just check whether DKIM passed. It checks whether the domain that signed the message is the same domain claiming to send it. Without alignment, a passing DKIM signature from an unrelated domain does nothing to satisfy DMARC.

There are two alignment modes you can configure in your DMARC record:

• Relaxed alignment: The DKIM signing domain and the From domain must share the same organizational domain. For example, a signature from mail.example.com would align with a From address at example.com.
• Strict alignment: The DKIM signing domain must exactly match the From domain. No subdomains are accepted as equivalent.

Relaxed alignment is the default and works well for most senders, especially those using subdomains for transactional or marketing email. Strict alignment gives you tighter control but requires careful coordination across all sending systems to avoid legitimate mail failing DMARC.

Alignment is what closes the loophole that allows spoofing. Without it, an attacker could sign a message with their own valid DKIM key and still appear to come from your domain in the visible From address.

What happens to an email when DKIM fails DMARC?

When DKIM fails DMARC, the receiving server checks the SPF result as a fallback. If SPF also fails or is not aligned, DMARC applies the policy set in your DNS record. Depending on your policy, the message will be delivered normally, placed in the spam folder, or rejected outright.

The three DMARC policy options are:

1. None (p=none): No action is taken on failing messages. This is a monitoring-only mode. Failures are reported, but mail is still delivered.
2. Quarantine (p=quarantine): Failing messages are sent to the recipient’s spam or junk folder.
3. Reject (p=reject): Failing messages are blocked entirely and never reach the recipient.

Regardless of which policy is active, DMARC generates aggregate reports that show you how many messages are failing and why. These reports are invaluable for diagnosing DKIM configuration problems before you move to a stricter policy. A DKIM failure does not automatically mean something malicious is happening. Misconfigured signing keys, forwarded messages, or third-party sending services that have not been properly authorized are common causes.

How does DMARC stop spoofing that DKIM alone cannot?

DMARC stops spoofing by enforcing a policy when authentication fails, and by requiring domain alignment. DKIM alone can verify that a message was signed, but it cannot dictate what happens if the signature is missing or forged. An attacker can send an email from your domain with no DKIM signature at all, and without DMARC, many mail servers will still deliver it.

DKIM also does not protect the From header directly. A sophisticated attacker can sign a message using their own domain’s valid DKIM key while displaying your domain in the From address visible to the recipient. To the recipient, the email looks like it came from you. DKIM passes for the attacker’s domain, but the visible sender is fraudulent.

DMARC closes this gap through the alignment requirement. Even if DKIM passes cryptographically, DMARC checks whether the signing domain matches the From domain. If it does not, DMARC fails and the policy is applied. This is what makes DMARC the critical enforcement layer in email authentication, not just an additional check.

Should you use both DKIM and SPF with DMARC?

Yes, you should use both DKIM and SPF alongside DMARC. DMARC only passes if at least one of them passes with proper alignment. Using both gives you redundancy. If one check fails due to a configuration issue or forwarding scenario, the other can still satisfy DMARC and keep legitimate mail flowing.

SPF and DKIM protect against different failure scenarios, which is why using both matters:

• SPF validates that the sending server’s IP address is authorized to send on behalf of your domain. It breaks when email is forwarded, because the forwarding server’s IP is not on your SPF list.
• DKIM validates the message content through a cryptographic signature. It survives forwarding because the signature travels with the message, but it can break if the message body is modified in transit.

Because each method has scenarios where it can fail legitimately, relying on only one creates risk. A message that fails SPF due to forwarding can still pass DMARC if DKIM is in place and aligned. That redundancy is especially important for senders who use mailing lists or have recipients who forward email frequently.

How do you check if DKIM and DMARC are working together correctly?

The most reliable way to check DKIM and DMARC alignment is to send a test email and inspect the full message headers on the receiving side. Look for the Authentication-Results header, which shows the outcome of each authentication check, including whether DKIM passed and whether DMARC alignment was confirmed.

Here is a practical approach to verifying your setup:

1. Send a test message to a mailbox you control, ideally at Gmail or another major provider that includes detailed authentication headers.
2. Open the full headers and find the Authentication-Results section. Look for dkim=pass and dmarc=pass.
3. Check the d= tag in the DKIM result to confirm the signing domain matches your From domain (or its organizational parent for relaxed alignment).
4. Review DMARC aggregate reports sent to the address specified in your DMARC record’s rua tag. These reports give a domain-level view of how your messages are performing across many receiving servers.
5. Use a DNS lookup tool to confirm your DKIM public key record is published correctly and that your DMARC record syntax is valid.

If DMARC reports show a significant percentage of messages failing, the most common causes are unsigned messages from third-party sending services, mismatched signing domains, or an SPF record that has not been updated to include all authorized senders. Addressing these before tightening your DMARC policy from none to quarantine or reject prevents legitimate mail from being blocked.

How Email Industries helps you get DKIM and DMARC right

Getting DKIM and DMARC working together correctly is not just a technical exercise. Misconfigured authentication directly affects inbox placement, sender reputation, and the trust your recipients place in your email. At Email Industries, we help organizations of all sizes navigate the full authentication setup process, from initial configuration to ongoing monitoring. Here is what we bring to the table:

• Full authentication audits to identify gaps in your DKIM, SPF, and DMARC setup across all sending domains and third-party services
• DMARC policy progression guidance that moves you safely from monitoring mode to enforcement without disrupting legitimate mail flows
• Alignment troubleshooting for complex environments where multiple ESPs, subdomains, or forwarding scenarios create authentication failures
• Ongoing deliverability monitoring to catch new authentication failures before they affect your sender reputation

Our Deliverability Assurance Packages are built specifically for teams who want expert oversight of their authentication infrastructure without managing it all in-house. You can also explore the full range of our services to find the right level of support for your needs. If you are unsure where your current setup stands or want help building a more resilient authentication stack, feel free to contact us and we will take it from there.

Related Articles

• Is DMARC mandatory now?
• What is DMARC and why do I need it?
• How do you maintain inbox placement during an email platform migration?
• How do you know when your email platform migration is complete?
• Can you warm up multiple domains at the same time?
• What types of emails should you send first during IP warming?
• How long does a domain warmup take?
• How do ecommerce email agencies increase online sales?
• What is email marketing compliance management?
• What email design services do agencies offer?
• How do you evaluate email marketing agency performance?
• What KPIs do email marketing agencies monitor?
• How do email deliverability agencies track inbox placement rates?
• How do deliverability agencies differ from ESP support teams?
• What is the process for deliverability audits?