SPF, DKIM, and DMARC: what each one actually does.
Three DNS-based technologies work together to establish which systems can send mail for your domain, prove message authenticity, and tell receivers what to do when authentication fails.
SPF controls authorized sending infrastructure
Sender Policy Framework publishes a DNS record describing which mail systems are allowed to send for a domain. Receivers compare the connecting sender with that policy. SPF alone is not a complete anti-spoofing system because forwarding and domain alignment can complicate the result.
DKIM signs the message
DomainKeys Identified Mail adds a cryptographic signature to a message. The receiving mail server retrieves the public key from DNS and verifies that selected message content has not been modified after signing. DKIM also gives the message an authenticated signing domain.
DMARC connects authentication to the visible From domain
DMARC evaluates whether SPF or DKIM passes with alignment to the domain the recipient actually sees in the From header. A domain owner can publish a monitoring or enforcement policy and request aggregate reports.
A sensible rollout
- Inventory every legitimate sender.
- Configure SPF without exceeding lookup limits.
- Enable DKIM for each sending platform.
- Publish DMARC in monitoring mode and review aggregate reports.
- Fix alignment problems.
- Move toward quarantine or reject when legitimate traffic is consistently authenticated.
Do not treat DMARC as a one-time DNS record
Mail providers, marketing tools, support systems, and infrastructure change. DMARC reporting is most useful when someone actually watches the reports and updates authentication as the sending environment changes.
Need help with the complete stack? See Truality Systems email-system services.