SPF, DKIM and DMARC: how email authentication works

SPF, DKIM and DMARC are DNS records that let a receiving mail server check where a message came from. SPF proves the sending server is allowed to send for the envelope sender's domain. DKIM proves a domain signed the message and that the signed parts were not changed.

DMARC ties those results to the From address people see. A message passes DMARC when SPF or DKIM passes for a domain that matches the From domain. The domain owner's DMARC policy tells receivers what to do with messages that fail.

SPF and DKIM on their own can pass for any domain the sender controls, including one unrelated to the From address. DMARC closes that gap.

SPF (Sender Policy Framework) is a TXT record at the domain in the envelope sender, also called the Return-Path or MAIL FROM address. The receiving server looks up that record and checks whether the connecting IP address matches one of its mechanisms.

Mechanisms include ip4, ip6, a, mx, include and all. Each can carry a qualifier: + for pass (the default), ? for neutral, ~ for softfail and - for fail. Terms are checked left to right and the first match decides, so -all at the end fails anything not listed. A domain must publish only one SPF record.

Evaluation may use at most 10 DNS lookups. The include, a, mx, ptr and exists mechanisms and the redirect modifier each count, including those inside included records, while ip4, ip6 and all do not. Going over the limit gives a permerror, and receivers should also return permerror after more than two void lookups, which find no records.

SPF checks the envelope sender, not the From header shown in mail clients. A message can pass SPF for a mailing service's bounce domain while showing your domain in From. SPF also usually fails on forwarded mail, because the forwarding server is not in your record.

DKIM (DomainKeys Identified Mail) adds a DKIM-Signature header to each message. The sending server signs chosen headers and a hash of the body with a private key. In the header, the d= tag names the signing domain and the s= tag names the key, called the selector.

The receiver fetches the public key from a TXT record at selector._domainkey under the signing domain, such as s1._domainkey.example.com, and verifies the signature. A pass proves that the d= domain signed the message and that the signed content has not changed since.

Selectors let a domain publish several keys at once, one per sending service or per key generation. To rotate a key, publish a new selector, switch signing to it, and remove the old key only once mail signed with it is no longer in transit. RFC 8301 sets 1024 bits as the minimum RSA key size and recommends 2048.

DKIM usually survives forwarding, because the signature travels with the message. Changes in transit, such as a mailing list adding a footer or a subject tag, can still break it.

DMARC (Domain-based Message Authentication, Reporting and Conformance) is a TXT record at _dmarc under your domain. A message passes when SPF passes and the envelope domain aligns with the From domain, or when DKIM passes and the d= domain aligns with it.

Alignment is relaxed by default, so the two domains only need to share an organizational domain: mail.example.com aligns with example.com. Strict alignment, set with aspf=s for SPF or adkim=s for DKIM, requires an exact match.

The p= tag sets the policy for failing mail. With p=none, the domain owner asks for no action beyond reporting. With p=quarantine, receivers should treat failing mail as suspicious, usually by filing it as spam, and with p=reject they should refuse it during delivery.

The rua= tag lists where receivers send aggregate reports, XML summaries of which servers sent mail as your domain and how they scored. The pct= tag applies the policy to only a percentage of failing mail, which allows a gradual move to quarantine or reject.

Move to a strict policy only after every legitimate sender passes, or DMARC will block your own invoices, password resets and newsletters. Email Authentication & Deliverability Studio shows which SPF terms use the 10-lookup budget as a tree and builds a DMARC record from a short form.

Passing SPF, DKIM and DMARC shows that mail is authorized by your domain. It does not put mail in the inbox, because receivers also weigh your sending reputation, spam complaint rates and the content of the message.

Large mailbox providers, including Gmail and Yahoo, require bulk senders to set up SPF, DKIM and DMARC. They also set other conditions, such as easy unsubscribing and low complaint rates, so check each provider's current sender guidelines for the exact requirements.

DMARC protects your domain and its subdomains. It does not stop lookalike domains such as examp1e.com, or a display name that copies your brand while the address belongs to someone else.