SPF vs DKIM vs DMARC: Understanding the Differences
Three protocols, one goal: prevent your email domain from being spoofed. Learn what sets them apart and why you need all three.
Why three protocols?
Email was designed in the 1980s without any authentication mechanism. Anyone could (and still can) send a message pretending to be someone else. To address this flaw, three complementary protocols were created over time:
- SPF (2006) — verifies that the sending server is authorized by the domain.
- DKIM (2007) — adds a cryptographic signature to the message to guarantee its integrity.
- DMARC (2012) — orchestrates SPF and DKIM, and tells receiving servers what to do when checks fail.
Each one covers a different aspect of authentication. Used separately, they leave gaps. Combined, they form a robust defense against spoofing and phishing.
Comparison Table
| Criteria | SPF | DKIM | DMARC |
|---|---|---|---|
| Purpose | Verify that the sending server is authorized | Guarantee message integrity and authenticity | Orchestrate SPF/DKIM and define failure policy |
| What it checks | Sending server IP address vs authorized IPs in DNS | Cryptographic signature in the message headers | Alignment of the From domain with SPF and/or DKIM |
| DNS record type | TXT | TXT (under _domainkey subdomain) | TXT (under _dmarc subdomain) |
| Sufficient alone? | No — does not protect the visible From header | No — does not tell the receiver what to do on failure | No — requires SPF and/or DKIM to function |
| RFC | RFC 7208 | RFC 6376 | RFC 7489 |
SPF at a Glance
SPF (Sender Policy Framework) is the first layer of protection. It lets you declare in DNS which servers are authorized to send emails on behalf of your domain.
- Works by comparing the sending server's IP against authorized IPs
- Protects against sending from unauthorized servers
- Limitation: only checks the envelope address (MAIL FROM), not the visible From header
- Maximum of 10 DNS lookups per record
DKIM at a Glance
DKIM (DomainKeys Identified Mail) adds a cryptographic signature to every outgoing email. The receiving server can verify this signature using the public key published in the sender's DNS.
- Ensures the message content has not been tampered with in transit
- Ties the message to a specific domain via a digital signature
- Survives email forwarding (unlike SPF)
- Limitation: does not tell the receiving server what to do if verification fails
DMARC at a Glance
DMARC (Domain-based Message Authentication, Reporting & Conformance) is the keystone that makes SPF and DKIM work together. It checks alignment: the From header domain must match the domain verified by SPF and/or DKIM.
- Defines a clear policy:
none(monitor),quarantine(spam),reject(block) - Sends reports on spoofing attempts
- Protects the visible From header (the gap SPF alone leaves open)
- Prerequisite: at least SPF or DKIM must be configured
How the 3 Work Together
Here is what happens when a server receives an email claiming to come from your domain:
- SPF check — The receiving server extracts the domain from the MAIL FROM address and checks whether the sender's IP is authorized in the SPF record. Result: pass or fail.
- DKIM check — The receiving server looks for a DKIM signature in the message headers, retrieves the public key from DNS, and verifies that the signature is valid. Result: pass or fail.
- DMARC check — The receiving server verifies that the From header domain is aligned with the domain verified by SPF and/or DKIM. Only one of the two needs to be aligned for DMARC to pass.
- Policy enforcement — If DMARC fails, the server applies the defined policy:
none(no action, but report sent),quarantine(send to spam), orreject(outright rejection).
This combination makes spoofing extremely difficult: an attacker would need to send from an authorized server (SPF), sign the message with your private key (DKIM), and have everything aligned with the From header (DMARC).
Where to Start?
Here is the recommended implementation order to protect your domain progressively:
- Configure SPF — List your sending servers and create your SPF record. This is the simplest to set up. See the SPF guide
- Configure DKIM — Enable DKIM signing with your email provider and publish the public key in your DNS. See the DKIM guide
- Deploy DMARC in monitoring mode — Start with
p=noneto collect reports without impacting deliverability. See the DMARC guide - Move to quarantine — Once you have analyzed reports and identified all legitimate sources, switch to
p=quarantineto send unauthenticated emails to spam. - Move to reject — When everything is stable, enable
p=rejectto permanently block unauthenticated emails. This is the maximum level of protection.
This progressive approach avoids accidentally blocking legitimate emails while steadily strengthening your security.
Frequently asked questions
What is the difference between SPF and DKIM?
SPF checks where the email comes from: it compares the sending server's IP address against the list of authorized servers published in your DNS. DKIM checks what the email contains: a cryptographic signature proves the message was not altered in transit and genuinely comes from your domain. SPF authenticates the server, DKIM authenticates the message. They are complementary, not interchangeable.
What is the difference between DKIM and DMARC?
DKIM signs your emails but tells the receiving server nothing: if the signature is invalid, nothing indicates whether to deliver the message, send it to spam, or reject it. DMARC fills that gap. It adds two things: a policy (none, quarantine, reject) and an alignment check between the signing domain and the domain shown to the recipient. DKIM is an authentication mechanism; DMARC is the decision rule built on top of it.
SPF, DKIM or DMARC: which one matters most?
DMARC, but it does not work alone. SPF and DKIM each produce a verdict, and DMARC is the only one of the three that protects the address your recipient actually sees — the From header. Without DMARC, an attacker can pass SPF using their own envelope domain while displaying yours. The three form a set: two proof mechanisms, and one policy that acts on them.
In which order should I set up SPF, DKIM and DMARC?
Always SPF, then DKIM, then DMARC. SPF is the fastest to publish and breaks nothing. DKIM requires enabling signing at every service that sends on your behalf. DMARC comes last, and must start at p=none: that monitoring phase shows you who is sending email with your domain before you block anything.
Can I use DMARC without SPF or DKIM?
Technically yes, but it is pointless and dangerous. DMARC has no verdict to act on if neither SPF nor DKIM is configured: every one of your emails will fail alignment. With p=reject, you would block your own legitimate mail. Publish SPF and DKIM first, confirm they pass, and only then roll out DMARC.
Check your domain for free
Test your SPF, DKIM, DMARC, and MTA-STS configuration in one click. Our tool analyzes your domain and tells you exactly what needs to be fixed.
Test my domain