mydnsreport.comAbout the project ↗
Home/Field notes/SPF vs DKIM vs DMARC: Email Authentication Comparison
FIELD NOTES

SPF vs DKIM vs DMARC: Email Authentication Comparison

Compare SPF sender authorization, DKIM signatures and DMARC alignment, with examples of what each check does and does not prove.

mydnsreport.com · Content & methodology
SPF or DKIM: Authentication → From domain: Alignment check → DMARC policy: none / quarantine / reject
DMARC passes when SPF or DKIM both passes and aligns with the visible From domain. The published policy guides handling of failures.

The named scenario below is a worked example for learning, not a verified incident report. Provider settings and outcomes vary.

Email Authentication Stack

Message leaves server

Checks sending IP

Verifies signature

Checks alignment

None/quarantine/reject

Inbox placement

🎯 Illustrative example: How All Three Protect Fatima's Domain

A scammer tries to send phishing email as fatima@company.com. Here's how each protocol catches it:

Scammer sends fake email

From: fatima@company.com, sent from scammer's server at IP 91.x.x.x.

SPF check runs

Receiver looks up company.com SPF record. 91.x.x.x is NOT in the allowed IP list → SPF FAIL.

DKIM check runs

Email has no DKIM signature (scammer doesn't have the private key) → DKIM FAIL.

DMARC evaluates results

SPF failed + DKIM failed. DMARC policy is p=reject.

Email rejected

Receiving server rejects the email entirely. Phishing attempt blocked. Recipient never sees it.

Fatima gets DMARC report

Aggregate report shows the spoofing attempt — IP, count, fail reasons. She can monitor threats.

SPF + DKIM + DMARC together = complete protection against email spoofing.

Any one alone has gaps. SPF without DMARC can be bypassed. DKIM without SPF can be replayed.

The Three Pillars of Email Authentication

Email was designed without built-in authentication. Anyone can send an email claiming to be from any domain. SPF, DKIM, and DMARC were created to fix this — each addressing a different part of the problem:

  • SPF — Verifies the sending server is authorized
  • DKIM — Verifies the message content hasn't been altered
  • DMARC — Ties SPF and DKIM to the visible From domain with a policy

Side-by-Side Comparison

FeatureSPFDKIMDMARC
PurposeAuthorize sending IPsSign message contentPolicy + reporting
DNS Record TypeTXT on domainTXT on selector._domainkeyTXT on _dmarc
What It ChecksEnvelope sender IPCryptographic signatureSPF/DKIM + alignment
Survives Forwarding No UsuallyDepends on SPF/DKIM
Prevents SpoofingPartiallyPartially Yes (with reject)
Sends Reports No No Yes
Standalone UsefulSomewhatSomewhatNeeds SPF/DKIM

SPF: Sender Policy Framework

SPF lets you publish a DNS record listing which IP addresses and servers are allowed to send email for your domain.

v=spf1 include:_spf.google.com include:sendgrid.net -all

Strengths: Easy to set up, widely supported

Weaknesses: Breaks on forwarding, 10-lookup limit, doesn't check From header

Setup guide: How to Set Up SPF

DKIM: DomainKeys Identified Mail

DKIM adds a cryptographic signature to email headers. The receiving server verifies the signature using a public key published in DNS.

selector._domainkey.example.com TXT "v=DKIM1; k=rsa; p=MIGfMA0..."

Strengths: Survives forwarding, proves message integrity, harder to spoof

Weaknesses: More complex setup (key generation), doesn't tell receivers what to do on failure

Setup guide: How to Set Up DKIM

DMARC: The Policy Layer

DMARC builds on SPF and DKIM by adding two critical things: alignment (the authenticated domain must match the From header) and a policy (what to do when authentication fails).

v=DMARC1; p=reject; rua=mailto:dmarc@example.com; aspf=r; adkim=r

Strengths: Prevents From-header spoofing, provides visibility via reports

Weaknesses: Requires SPF/DKIM already configured, forwarding can cause false failures

Setup guide: How to Set Up DMARC

How They Work Together

Here's the flow when a receiving server processes an incoming email:

  1. SPF check — Is the sending IP authorized by the domain's SPF record?
  2. DKIM check — Does the DKIM signature verify against the published public key?
  3. DMARC alignment — Does the domain from SPF or DKIM match the From header?
  4. DMARC policy — If alignment fails, apply the policy (none / quarantine / reject)
  5. DMARC reporting — Send an aggregate report to the domain owner

Key insight: SPF or DKIM can pass on their own, but DMARC will still fail if the authenticated domain doesn't align with the From header.

  1. SPF first — Easiest to configure; list your sending sources
  2. DKIM second — Generate keys and publish DNS records for each sender
  3. DMARC last — Start with p=none, monitor reports, then enforce

Frequently Asked Questions

What is the difference between SPF, DKIM, and DMARC?

SPF verifies which servers can send email for your domain. DKIM cryptographically signs emails to prove they haven't been tampered with. DMARC ties them together with a policy that tells receivers what to do when authentication fails.

Do I need all three?

Yes. Each covers a different aspect. SPF alone doesn't prevent From-header spoofing, DKIM alone doesn't enforce policy, and DMARC needs at least one of SPF or DKIM to function.

Which should I set up first?

SPF first (easiest), then DKIM (requires key generation), then DMARC last (depends on the other two). Start DMARC with p=none for monitoring.