Skip to content
Back to Blog
DMARC.WS Team··7 min read

SPF vs DKIM vs DMARC Explained: What's the Difference?

SPFDKIMDMARCComparison

The Three Pillars of Email Authentication

Email authentication relies on three complementary protocols that each solve a different piece of the puzzle. Think of them as layers of security — each one adds protection the others can't provide alone.

SPF (Sender Policy Framework)

What it does: SPF verifies that the sending mail server's IP address is authorized to send email for your domain.

How it works:

  1. You publish a DNS TXT record listing authorized IP addresses and servers
  2. When an email arrives, the receiving server checks the envelope sender's domain
  3. It looks up the SPF record and verifies the sending IP is on the list

Example SPF record:

v=spf1 include:_spf.google.com include:sendgrid.net -all

Limitations:

  • Only checks the envelope sender (Return-Path), not the visible From header
  • Breaks when emails are forwarded
  • Limited to 10 DNS lookups

DKIM (DomainKeys Identified Mail)

What it does: DKIM adds a cryptographic signature to outgoing emails that proves the message hasn't been tampered with and was sent by an authorized sender.

How it works:

  1. Your mail server signs outgoing emails with a private key
  2. The public key is published as a DNS TXT record
  3. Receiving servers verify the signature against the public key

Example DKIM DNS record:

selector._domainkey.example.com TXT "v=DKIM1; k=rsa; p=MIGfMA0..."

Advantages over SPF:

  • Survives email forwarding (the signature travels with the message)
  • Verifies message integrity (detects tampering)
  • Signs the visible From header

DMARC (Domain-based Message Authentication, Reporting, and Conformance)

What it does: DMARC ties SPF and DKIM together and adds policy enforcement and reporting.

The missing piece: Without DMARC, even if SPF and DKIM fail, the receiving server has no instructions on what to do. DMARC tells it: "If authentication fails, here's what to do."

Key additions:

  • Alignment — Requires SPF or DKIM to match the From header domain
  • Policy — Tells receivers to none/quarantine/reject failing mail
  • Reporting — Sends daily aggregate reports back to the domain owner

How They Work Together

Feature SPF DKIM DMARC
Checks sender IP Yes No No
Checks message integrity No Yes No
Survives forwarding No Yes N/A
Policy enforcement No No Yes
Reporting No No Yes
Alignment checking No No Yes

Do I Need All Three?

Yes. Here's why:

  • SPF alone can be bypassed via forwarding and doesn't check the From header
  • DKIM alone doesn't tell receivers what to do with unsigned messages
  • DMARC alone doesn't work — it requires SPF or DKIM (or both) to function

The strongest configuration uses all three:

  1. SPF authorizes your sending IPs
  2. DKIM signs your messages cryptographically
  3. DMARC enforces policy and gives you reporting visibility

Quick Setup Checklist

  1. Publish an SPF record for your domain
  2. Enable DKIM signing on your email provider
  3. Publish a DMARC record starting with p=none
  4. Monitor your DMARC reports using DMARC.WS
  5. Gradually move to p=quarantine then p=reject