SPF, DKIM, and DMARC are three distinct email authentication protocols that work together to verify that emails sent from your domain are legitimate. SPF specifies which mail servers are authorized to send on your behalf, DKIM adds a cryptographic signature to prove a message has not been tampered with, and DMARC tells receiving servers what to do when either of those checks fails. Together, they form the foundation of modern email security.
Each protocol addresses a different angle of the same problem: preventing bad actors from spoofing your domain to send fraudulent or malicious email. No single protocol covers every gap, which is why inbox providers and major senders increasingly expect all three to be in place. The sections below walk through how each one works, what happens when they fail, and how to set them up correctly.
How do SPF, DKIM, and DMARC each protect your domain?
SPF, DKIM, and DMARC protect your domain at three different points in the email delivery process. SPF validates the sending server, DKIM validates the message content, and DMARC enforces a policy when either of those validations fails. Understanding what each one does individually makes it much easier to see why all three are needed together.
SPF: authorizing your sending sources
Sender Policy Framework (SPF) works by publishing a DNS record that lists every IP address or mail server authorized to send email from your domain. When a receiving server gets a message claiming to come from your domain, it checks that record. If the sending server is not on the list, the message fails SPF. SPF is effective at blocking simple spoofing attempts, but it has a limitation: it only checks the envelope sender address used during the SMTP handshake, not the “From” address your recipients actually see.
DKIM: signing your messages
DomainKeys Identified Mail (DKIM) adds a cryptographic digital signature to the email header. Your sending server signs outgoing messages with a private key, and the corresponding public key is published in your DNS. The receiving server retrieves that public key and uses it to verify the signature. If the message was altered in transit, the signature breaks. DKIM proves both that the message came from your domain and that it arrived intact.
DMARC: enforcing the rules
Domain-based Message Authentication, Reporting, and Conformance (DMARC) sits on top of SPF and DKIM. It tells receiving servers what to do when a message fails one or both checks: do nothing (none), send it to the spam folder (quarantine), or reject it outright (reject). DMARC also enables reporting, so domain owners receive data about who is sending email on their behalf, including sources they may not have authorized.
What happens when an email fails SPF, DKIM, or DMARC checks?
When an email fails SPF or DKIM, the outcome depends on what your DMARC policy instructs the receiving server to do. Without a DMARC record, most servers apply their own filtering logic, which varies widely. With a DMARC policy in place, the behavior becomes predictable and controlled by you as the domain owner.
Here is what each failure scenario typically means in practice:
- SPF failure alone: The sending server is not listed in your SPF record. The message may be flagged or filtered, but without DMARC enforcement, it will often still be delivered.
- DKIM failure alone: The signature is missing, invalid, or the message was modified after signing. Again, DMARC determines how strictly this is treated.
- DMARC failure: When a message fails both SPF and DKIM alignment, DMARC kicks in. A none policy means the message is delivered, but you receive a report. A quarantine policy sends it to spam. A reject policy blocks it entirely.
The value of DMARC reporting should not be underestimated. Even before you move to a stricter policy, setting DMARC to none and monitoring the reports gives you a clear picture of every source sending email from your domain, legitimate or otherwise.
Do you need all three — SPF, DKIM, and DMARC?
Yes, you need all three. SPF and DKIM each protect against different types of abuse, and DMARC is what ties them together into an enforceable policy. Relying on only one or two leaves meaningful gaps in your domain’s protection and limits your visibility into how your domain is being used.
Since 2024, major inbox providers including Google and Yahoo have required bulk senders to have SPF, DKIM, and DMARC configured. In 2026, these requirements continue to shape deliverability outcomes for senders of all sizes. A missing or misconfigured protocol can result in legitimate mail being filtered or rejected, and it leaves your domain exposed to spoofing and phishing attacks that damage your brand reputation with recipients.
What is DMARC alignment and why does it matter?
DMARC alignment is the requirement that the domain in the “From” header matches the domain used in either the SPF check or the DKIM signature. A message can technically pass SPF or DKIM and still fail DMARC if those authenticated domains do not align with the visible “From” address. Alignment is what closes the gap that SPF and DKIM leave open on their own.
There are two alignment modes to understand:
- Relaxed alignment: The authenticated domain only needs to share the same organizational domain as the “From” address. For example, a subdomain like mail.yourdomain.com aligns with yourdomain.com.
- Strict alignment: The authenticated domain must match the “From” domain exactly. Subdomains do not satisfy strict alignment.
Most senders start with relaxed alignment, which accommodates common sending setups involving subdomains and third-party services. Strict alignment offers stronger protection but requires more precise configuration across all your sending sources.
Which email authentication protocol should you set up first?
Set up SPF first, then DKIM, and finally DMARC. This order is logical because DMARC depends on the results of SPF and DKIM checks. Deploying DMARC before those two are correctly configured and validated would result in immediate failures for your own legitimate mail.
A practical setup sequence looks like this:
- Publish your SPF record: Identify all IP addresses and services authorized to send email from your domain and add them to a TXT record in your DNS.
- Enable DKIM signing: Generate a DKIM key pair through your email service provider or mail server, publish the public key in DNS, and confirm that outgoing messages are being signed.
- Add a DMARC record at none: Start with a monitoring-only policy to collect reports without affecting mail flow. Review the reports to identify all sending sources and confirm SPF and DKIM alignment.
- Gradually tighten your DMARC policy: Once you are confident that legitimate mail is passing authentication, move from none to quarantine, then eventually to reject.
Rushing to a reject policy before fully auditing your sending infrastructure is one of the most common mistakes senders make. The monitoring phase exists specifically to prevent disrupting your own mail flow.
How can you check if SPF, DKIM, and DMARC are set up correctly?
You can check your SPF, DKIM, and DMARC configuration by inspecting your DNS records and analyzing email headers. Several free tools allow you to look up your DNS records directly, and sending a test email to a header analysis tool will show you whether each protocol is passing or failing in practice.
Here are the most reliable methods:
- DNS lookup tools: Search for your domain’s TXT records to view your SPF and DMARC entries. DKIM records are stored under a selector prefix, so you will need to know the selector your sending provider uses.
- Email header analysis: Send a test message and examine the full headers. Look for the Authentication-Results header, which shows whether SPF, DKIM, and DMARC each passed or failed and why.
- DMARC aggregate reports: Once your DMARC record includes a reporting address (rua tag), you will receive XML reports from inbox providers. These reports show every source sending email from your domain and the authentication results for each.
- Dedicated validation tools: Purpose-built tools can test all three protocols simultaneously, flag configuration errors, and highlight alignment issues that manual inspection might miss.
Checking your setup once is not enough. Sending infrastructure changes over time as you add new services, migrate platforms, or update your DNS. Regular audits ensure your authentication records stay accurate and complete.
How Email Industries helps with email authentication
At Email Industries, we work with organizations every day that are either starting from scratch with SPF, DKIM, and DMARC or trying to untangle a broken configuration that is silently hurting their deliverability. Getting authentication right is not always straightforward, especially for senders using multiple ESPs, CRMs, or third-party services that all need to be accounted for in your records.
Here is what we bring to the table:
- Full authentication audits: We review your existing SPF, DKIM, and DMARC records, identify gaps, and flag alignment issues before they cause deliverability problems.
- DMARC policy implementation: We guide you through the monitoring phase and help you move safely toward a reject policy without disrupting legitimate mail flow.
- Ongoing monitoring and reporting: We help you interpret DMARC aggregate reports and act on what they reveal about unauthorized senders using your domain.
- Deliverability protection: Authentication is one layer of a broader deliverability strategy. Our Deliverability Assurance Packages combine authentication support with inbox placement monitoring, reputation management, and expert guidance.
- Tailored consulting: Whether you are a SaaS company, an eCommerce brand, or a healthcare organization, we adapt our approach to your specific sending environment and compliance requirements. Explore our full range of services to see how we can help.
If you are unsure whether your email authentication is configured correctly or you want to move toward a stronger DMARC policy with confidence, we are here to help. Feel free to contact us, and we will take a look together.
Related Articles
- What is a DKIM selector and how does it work?
- What is a DMARC aggregate report and what does it tell you?
- Is DMARC mandatory now?
- How do email advertising agencies approach seasonal campaigns?
- How do email advertising agencies handle client retention?
- What documentation do full service agencies require during setup?
- What authentication records do you need to update when switching email platforms?
- Can you migrate email platforms without damaging your sender reputation?
- What are the most common mistakes made during email platform migrations?
- Can you run IP warming on a shared IP address?
- What engagement metrics matter most during IP warming?
- How do ecommerce email agencies handle cart abandonment campaigns?
- How do agencies handle email consent management?
- Can email marketing services agencies integrate with existing CRM systems?
- How long does it take to improve email deliverability?
