In short: SPF identifies permitted sending systems, DKIM adds a cryptographic signature, and DMARC checks alignment and tells receiving providers how to handle failures. They work together but solve different parts of email authentication.
| Control | What it proves | Published at |
|---|---|---|
| SPF | The sending server is authorised for the envelope-from domain | The domain as a TXT record |
| DKIM | The message carries a valid signature for the signing domain | A selector below _domainkey |
| DMARC | SPF or DKIM passes and aligns with the visible From domain | _dmarc.example.com |
Why all three matter
SPF alone does not protect the address people see in the From header, and it can be affected by forwarding. DKIM can survive forwarding when the message is not altered. DMARC joins the results to the visible sender domain and supports aggregate reporting.
Important SPF rule
A domain must publish only one SPF policy. If several services send mail, combine their authorised mechanisms into that single record rather than adding multiple v=spf1 TXT records.
Introduce DMARC safely
Start with monitoring, review reports, correct legitimate senders, then move deliberately towards quarantine or reject. Publishing a strict policy before all senders authenticate can cause genuine mail to be rejected.
What authentication does not do
It improves identity and reputation signals but does not guarantee inbox placement. Content, complaint rates, sending history, reverse DNS and recipient policy also influence delivery.
