SPF vs DKIM vs DMARC Explained

SPF, DKIM and DMARC are three DNS-based standards that help receivers decide whether a message really came from the domain it claims. They are often mentioned together, but each one checks something different, and the differences explain most of the confusing results you see in email headers.

The short version

SPF

Sender Policy Framework lets a domain publish, in a DNS TXT record, which servers may send mail using that domain in the SMTP envelope. The receiver compares the connecting IP address with that list. Because it looks at the envelope rather than the visible From, SPF alone does nothing to stop someone from forging the From address that people see. Forwarding often breaks SPF, since the forwarder's IP is not on the original domain's list.

DKIM

DomainKeys Identified Mail adds a cryptographic signature to the message. The signing domain publishes a public key in DNS under a selector, and a receiver uses it to check that the signed headers and body were not modified. DKIM survives forwarding if the message is unchanged, but mailing lists that edit the subject or footer can break it. The signing domain (d=) does not have to match the From domain, so a valid signature does not by itself tie the message to the address the reader sees.

DMARC

Domain-based Message Authentication, Reporting and Conformance joins the two. A message passes DMARC if SPF or DKIM passes and the passing domain aligns with the From domain. The domain owner publishes a policy of none, quarantine or reject, which tells receivers what to do with failures, and can request reports.

Alignment in one example

From:         [email protected]
Return-Path:  [email protected]   (SPF passes for example.net)
DKIM d=       example.com                  (DKIM passes for example.com)

SPF aligned?  No  (example.net is not example.com)
DKIM aligned? Yes (example.com matches the From domain)
DMARC:        PASS (one aligned pass is enough)

Alignment can be strict (exact match) or relaxed (same organizational domain, so mail.example.com aligns with example.com). Relaxed is the default.

Reading the results in headers

The receiving server normally records its verdicts in an Authentication-Results header, for example spf=pass, dkim=pass and dmarc=pass. Those are the receiver's reported results, so a viewer should read them as that server's statement. The Email Header Analyzer lays out each result with the domains involved and shows how the From, DKIM and SPF domains line up. Web teams will recognize the pattern from the HTTP Security Headers Analyzer and the CSP Analyzer: each reads a set of signals and reports what is present, not whether the whole system is safe.