DMARC, SPF, DKIM: the differences, explained simply

Three acronyms, three DNS records, and a stubborn confusion. They are not interchangeable and do not replace one another: each answers a question the other two do not ask.

SPF: which servers are allowed to send

SPF is a list of authorised addresses, published in your DNS. The receiving server looks at where the connection came from and checks that this address is on your list.

It has two limits. First, it validates the envelope domain (the Return-Path), not the one the recipient sees. Second, it breaks on forwarding: when a message is re-sent, the server address changes and SPF fails, even though the message is perfectly legitimate.

One SPF record per domain, always. Two records invalidate both.

DKIM: a signature that travels with the message

The sending server signs the message with a private key; the matching public key is published in your DNS under a selector. The recipient verifies the signature.

Its decisive advantage over SPF: the signature is inside the message. It survives forwarding, mailing lists and relays. That is precisely why SPF alone is never enough.

DMARC: tying all of it to the visible domain

SPF and DKIM authenticate technical domains the user never sees. Nothing stops a fraudster from passing SPF on their domain while displaying yours in the From: header.

DMARC closes that door with three contributions:

• Alignment: the domain validated by SPF or signed by DKIM must match the one shown in the From:. One of the two is enough.
• A policy: you tell recipients what to do when it fails — nothing, quarantine, or reject.
• Reports: you receive a daily account of what was seen in your name. Here is how to read them.

One sentence each

• SPF — « these servers may send for me ».
• DKIM — « this message carries my signature, and it can be verified ».
• DMARC — « if neither matches the displayed name, here is what to do about it, and tell me ».

In which order to publish them

SPF and DKIM first, DMARC afterwards and in monitoring mode. Publishing a strict policy before authentication works amounts to asking the world to reject your own mail. The guides by provider give the exact values for whoever sends on your behalf.