SPF, DKIM & DMARC: Email Authentication Basics

The SPF Record Builder can help assemble a basic SPF value after you inventory your senders. Email authentication is easier to understand when SPF, DKIM, and DMARC are treated as three related but different checks. They do not replace each other, and passing one does not guarantee inbox placement.

SPF: is this sending server authorized?

SPF publishes a DNS policy describing which systems can send mail using a domain in the SMTP envelope. It is tied to the sending path and can break during traditional forwarding.

DKIM: was the signed message altered?

DKIM adds a cryptographic signature to the message. The receiving server retrieves a public key from DNS and verifies the signature. A valid signature shows that signed parts of the message have not been modified after signing and identifies the signing domain.

DMARC: does authentication align with the visible From domain?

DMARC builds on SPF and DKIM. It checks whether at least one passing authentication method aligns with the domain the user sees in the From header. It also lets domain owners publish a handling policy and request aggregate reports.

Why alignment matters

A third-party system can legitimately pass SPF for its own envelope domain while the message displays your brand domain in From. DMARC alignment determines whether that passing authentication supports the visible identity.

Roll out changes carefully

1. Inventory all legitimate senders.
2. Make sure each has working SPF and/or DKIM.
3. Publish DMARC in a monitoring posture when appropriate.
4. Review reports for forgotten or misconfigured senders.
5. Increase enforcement only when legitimate mail is aligned.

Authentication is not the same as deliverability

Mailbox providers also consider reputation, complaint rates, engagement, content, sending patterns, and list quality. Authentication is foundational, but it cannot make unwanted or poorly managed mail desirable.