SPF vs DKIM vs DMARC: What's the Difference?

Overview

If you are trying to set up business email correctly, SPF, DKIM, and DMARC are the three DNS records you are most likely to hear about. They are related, but they do different jobs.

The simplest way to think about them is this:

• SPF checks who is allowed to send
• DKIM checks whether the message was signed
• DMARC checks whether the visible sender matches the authenticated domain and what to do if it does not

That summary is useful, but the details matter because mail providers do not treat the three records as duplicates. A setup that only has SPF may still be weak. A setup with DKIM but no DMARC may still be spoofable. A DMARC policy without working SPF or DKIM may break legitimate mail.

SPF: the sending permission list

SPF stands for Sender Policy Framework. It is a DNS record that lists the servers or services allowed to send email for your domain.

If a message comes from a server that is not on the SPF list, the receiving mail system can treat that as suspicious. SPF is useful because it makes it harder for someone to send mail from your domain using an unauthorised server.

SPF has limits, though. It checks the sending path rather than the content of the message. If email is forwarded, the SPF result can change. SPF also cannot tell the recipient whether the content was altered after it left the sender.

DKIM: the message signature

DKIM stands for DomainKeys Identified Mail. It signs the message using a private key and lets the recipient verify the signature with a public key in DNS.

The value of DKIM is that it covers the message itself, not just the sending server. If the content changes in a way that breaks the signature, the check fails. That gives the recipient another trust signal.

DKIM is especially helpful when an email passes through multiple systems on the way to the inbox. In some cases, SPF can fail through forwarding or relay systems, while DKIM still passes if the signed content is preserved.

DMARC: the policy layer

DMARC sits on top of SPF and DKIM. It does two jobs:

• It checks whether SPF or DKIM passed in an aligned way.
• It tells the recipient what to do if the message fails.

That makes DMARC more than a technical check. It is also a policy statement. The domain owner is saying how strictly unauthorised mail should be handled.

DMARC is the record that lets a business move from “we have some authentication” to “we have an enforceable authentication policy.”

How they work together

In a healthy setup, SPF and DKIM provide the evidence, and DMARC interprets that evidence.

For example, if your marketing platform sends email on your behalf, you might authorise it in SPF and sign its messages with DKIM. DMARC then checks whether either of those methods passed and whether the authenticated domain aligns with the From: domain the recipient sees.

If only one of SPF or DKIM passes, that may still be enough for DMARC, depending on alignment. If neither passes, DMARC can tell the recipient to quarantine or reject the message, depending on your policy.

That is why setting all three up properly matters. They are not three copies of the same thing. They are three layers in the same trust system.

A simple comparison table

That table is intentionally simplified. Real-world delivery depends on the mailbox provider, message content, sender reputation, and many other signals. But as a starting point, it is accurate enough to help you reason about setup.

Which one should you fix first?

Which one matters most?

If you can only think about one at a time, start with SPF and DKIM. They are the building blocks. Without them, DMARC has very little to work with.

If you already have SPF and DKIM in place, DMARC is usually the next important step because it turns authentication into a policy. That is especially true for organisations that send customer communications from a branded domain.

If you are receiving email for a business domain, DMARC also helps protect your brand from being used by others. That can matter even if you do not send much mail yourself.

Common misunderstandings

One common misunderstanding is that SPF, DKIM, and DMARC all do the same thing. They do not. That confusion often leads to partial setup and false confidence.

Another misunderstanding is that a pass result means the email is safe. It does not. Authentication can tell you that the message came through a permitted path and was signed correctly, but it cannot tell you whether the sender was malicious, whether the account was compromised, or whether the content is fraudulent.

Another problem is assuming providers enforce the rules identically. They do not. Different mailbox providers can treat borderline cases differently, especially when forwarding, aliases, or third-party senders are involved.

What to do in practice

For most businesses, the sensible order is:

• Confirm the domain has an SPF record that covers legitimate sending services.
• Confirm DKIM is enabled for those services.
• Add DMARC with p=none while you monitor.
• Move to quarantine or reject once you know all valid senders are covered.

That is a practical route because it reduces the chance of blocking good mail. It also gives you time to identify forgotten senders such as billing tools, marketing platforms, support systems, or website forms.