Email Security: SPF, DKIM & DMARC

SPF vs DKIM vs DMARC: The 30-Second Comparison

They're not competing options — they're three layers that do different jobs and are strongest together. In one line: SPF says which servers may send for your domain, DKIM cryptographically signs your mail so it can't be tampered with, and DMARC ties the two to your visible From: address and tells receivers what to do when a message fails.

The rest of this guide covers each layer in depth, then which to set up first. A message passes DMARC if it passes SPF or DKIM and that passing check is aligned with the From: domain.

Why Email Authentication Matters

By default, anyone can send email pretending to be from your domain. Email authentication prevents this by allowing receiving servers to verify that emails actually came from authorized senders.

SPF (Sender Policy Framework)

SPF is a TXT record that lists which mail servers are authorized to send email on behalf of your domain.

SPF Syntax Breakdown

Common SPF Records

DKIM (DomainKeys Identified Mail)

DKIM adds a digital signature to your emails. The receiving server verifies this signature using a public key published in your DNS.

DKIM Record Format

DKIM records are TXT records with a specific selector name:

Each email service uses its own selector (like google, selector1, k1). Your email provider will give you the exact record to add.

DMARC (Domain-based Message Authentication)

DMARC tells receiving servers what to do when emails fail SPF or DKIM checks. It also enables reporting so you can monitor authentication results.

DMARC Policy Options

DMARC Tags Explained

How They Work Together

SPF, DKIM, and DMARC form a complete email authentication system:

For an email to pass DMARC, it must pass either SPF or DKIM (with alignment to the From domain).

Which Do You Need First?

You want all three eventually — but set them up in this order:

1. SPF first — it's the simplest and most widely checked. Publish one clean record. Generate one here, then validate it.
2. DKIM next — enable signing at your email provider and publish the public key they give you.
3. DMARC last, at p=none — start in monitor-only mode and read the reports. Once your legitimate senders all pass, tighten to quarantine, then reject.

SPF and DKIM are the locks; DMARC is what says "and actually enforce the locks — and tell me who's trying the door." The fastest way to see where you stand today is a one-click email authentication check.

Implementation Checklist

Frequently Asked Questions

What's the difference between SPF, DKIM, and DMARC?

SPF authorizes sending servers, DKIM cryptographically signs messages, and DMARC ties both to your visible From: address and decides what happens when mail fails. They're layers, not alternatives.

Do I need all three?

Yes, for full protection. SPF and DKIM each provide authentication; DMARC enforces alignment with the From: domain and gives you reporting. Any one alone leaves a gap.

Is DMARC better than SPF or DKIM?

It's not better — it's different. DMARC depends on SPF and DKIM; it can't authenticate anything by itself. It's the enforcement and reporting layer on top.

What's the difference between DKIM and DMARC?

DKIM signs a message to prove it wasn't altered. DMARC checks that DKIM (or SPF) passed and aligns with the From: domain, then applies a policy and reports the results.

What's the difference between SPF and DKIM?

SPF checks which server sent the mail (by IP). DKIM checks that the message itself is genuine and unaltered (by signature). SPF breaks on forwarding; DKIM survives it because the signature travels with the message.