SPF vs DKIM vs DMARC: What's the Difference and Why You Need All Three

If you've read about email authentication, you've run into these three acronyms — and it's easy to assume you only need one. In reality, SPF, DKIM, and DMARC solve three different problems, and skipping any one of them leaves a real gap an attacker can exploit.

This guide lays out exactly what each protocol does, how they work together, and gives you a step-by-step checklist to audit your own domain in the next ten minutes.

---

1. The Short Answer

In short: SPF checks the server. DKIM checks the message. DMARC checks that they both agree with what the recipient actually sees, and enforces a policy.

---

2. Why SPF Alone Isn't Enough

SPF only validates the hidden envelope sender (the technical "return path"), not the visible "From" address a recipient sees in their inbox. An attacker can pass SPF validation on their own domain while still displaying From: yourbank@yourdomain.com in the header a human actually reads. SPF has no mechanism to catch that mismatch — that gap is exactly what DMARC closes.

SPF also breaks when email is forwarded through a third party, since the forwarding server's IP isn't on your authorized list.

Full breakdown: SPF Record Explained

---

3. Why DKIM Alone Isn't Enough

DKIM proves a message wasn't tampered with and was signed by a legitimate key — but it doesn't require the signing domain (d= in the signature) to match the visible "From" address either. An attacker can register a lookalike domain, sign their phishing email with valid DKIM for that domain, and still forge your brand name in the "From" display name.

DKIM also silently breaks if a mailing list or forwarder modifies the subject line or body, since that invalidates the cryptographic hash.

Full breakdown: DKIM Explained

---

4. What DMARC Adds

DMARC (Domain-based Message Authentication, Reporting & Conformance) is the policy layer sitting on top of both. It does three things SPF and DKIM can't do alone:

1. Alignment checking — confirms the domain in the visible "From" header actually matches the domain that passed SPF and/or DKIM.
2. Enforcement policy — tells receiving servers exactly what to do with a message that fails alignment:
   • p=none — take no action, just report (monitoring mode).
   • p=quarantine — send failing mail to spam/junk.
   • p=reject — block the message outright.
3. Reporting — receiving servers (Gmail, Yahoo, Outlook) send back aggregate reports showing who is sending mail using your domain and whether it's passing — including unauthorized senders you may not know about.

A basic DMARC record looks like this:

Host: _dmarc.yourdomain.com
Type: TXT
Value: v=DMARC1; p=quarantine; rua=mailto:reports@yourdomain.com

Most domains should start at p=none to monitor traffic safely, then move to quarantine and eventually reject once confident all legitimate senders are properly aligned with SPF and DKIM.

---

5. How the Three Work Together

Picture the full flow when an email arrives in a recipient's inbox:

1. SPF check — does the sending server's IP match the domain's authorized list?
2. DKIM check — does the cryptographic signature verify against the published public key?
3. DMARC check — does the domain that passed SPF or DKIM actually align with the visible "From" address? If yes, DMARC passes. If not, DMARC applies its policy (none/quarantine/reject).

Important: DMARC only requires one of SPF or DKIM to pass and align — not both. This is why having both configured (rather than just one) gives you redundancy: if one breaks due to forwarding or a broken selector, the other can still carry the domain to a DMARC pass.

---

6. A Real-World Spoofing Scenario

Imagine your domain has SPF configured but no DKIM or DMARC. An attacker registers a similar-looking domain, sends a phishing email with From: support@yourcompany.com in the display name, and routes it through their own mail server.

• SPF check on the attacker's actual sending domain: passes (they're sending from their own authorized server).
• Visible "From" the recipient sees: still shows your brand.
• Without DMARC, nothing checks whether those two facts contradict each other — the email lands in the inbox looking completely legitimate.

Add DMARC, and this scenario fails immediately: the visible "From" domain doesn't align with anything that passed SPF or DKIM for your domain, so the policy kicks in and the message is quarantined or rejected before it ever reaches the inbox.

---

7. Audit Your Domain: Step-by-Step Checklist

Run through this in order — each step builds on the last, and it's the same troubleshooting flow used in our MX records guide:

1. Confirm mail routing. Check your MX Lookup Tool to verify your domain's mail servers are correctly configured.
2. Check SPF. Run the SPF Checker — confirm one record, correct includes for every sending service, and under 10 DNS lookups.
3. Check DKIM. Run the DKIM Checker for every selector your mail providers use — confirm valid, un-truncated public keys.
4. Check general DNS health. Use the DNS Checker to rule out unrelated propagation issues affecting any of the above.
5. Check deliverability reputation. Run the Email Blacklist Checker — even perfect authentication won't help if your sending IP is already blacklisted. See our blacklist guide for the full walkthrough.
6. Publish or review your DMARC record, starting at p=none to monitor before enforcing.

---

FAQ

Do I need all three, or is one enough? All three, ideally. SPF and DKIM alone leave the "From" address spoofing gap open. DMARC without SPF or DKIM configured underneath it has nothing to enforce.

Will DMARC block my own marketing emails by mistake? Only if your legitimate senders (marketing platforms, CRMs, transactional email tools) aren't properly included in your SPF record or signing with an aligned DKIM domain. Start with p=none and review reports before enforcing reject.

How do I know if DMARC is already set up for my domain? Check for a TXT record at _dmarc.yourdomain.com using the DNS Checker. No record means no DMARC protection at all, regardless of your SPF/DKIM status.

Which should I set up first? SPF first (fastest to configure), then DKIM, then DMARC last — since DMARC's effectiveness depends on the other two already being correctly aligned.