Guide
SPF vs DKIM vs DMARC, Explained
SPF checks which servers may send for your domain, DKIM checks a signature on the message itself, and DMARC checks that one of them matches the From address people see, then tells receivers what to do if neither does.
- SPF
- PASS with IP 203.0.113.7
- DKIM
- PASS with domain northwind.io
- DMARC
- PASS
DMARC passed because SPF and DKIM both passed for northwind.io, the From domain.
Side by side
SPF vs DKIM vs DMARC in one table
All three are DNS records that receiving mail servers look up on every message. They answer different questions, which is why you need all three.
| SPF | DKIM | DMARC | |
|---|---|---|---|
| What it checks | The sending server is allowed to send for the envelope domain. | The message was signed by the domain and not changed in transit. | SPF or DKIM passed for the domain in the visible From address. |
| Domain it looks at | Return-Path (MAIL FROM), plus the HELO name | The d= domain in the DKIM-Signature header | The From header domain |
| DNS record | TXT at the root: v=spf1 … | TXT at selector._domainkey | TXT at _dmarc: v=DMARC1 … |
| Protects against | Unauthorized servers using your bounce domain | Tampered messages and forged signatures | Spoofing of the address recipients actually see |
| Survives forwarding? | No. The forwarder's IP isn't in your record. | Usually, unless the forwarder edits the message. | Yes, if DKIM survives. |
| Gmail & Yahoo require it? | All senders need SPF or DKIM; bulk senders both | All senders need SPF or DKIM; bulk senders both | Bulk senders, p=none or stricter |
| Standard | RFC 7208 | RFC 6376 | RFC 9989 (May 2026, replaced RFC 7489) |
Microsoft added the same rule for Outlook.com: from 5,000 messages to its consumer inboxes, SPF and DKIM must pass and DMARC must pass in alignment, or mail bounces with 550 5.7.515. See the deliverability guide for the full sender requirements.
How it works
How one email passes all three checks
Every message carries two sender domains: the hidden envelope sender used for bounces and the From address shown to the reader. Spammers can set either one freely, so each check verifies a different piece.
What each check reads from one email
SPF and DKIM each verify a different domain in the message. DMARC ties them to the From address.
That last step is called alignment. SPF or DKIM can pass for some other domain, such as your email service's, and DMARC will still fail. By default DMARC accepts a match on the same organizational domain, so mail.northwind.io aligns with northwind.io. If you're seeing failures, the DMARC fail guide decodes every error.
Records
What are SPF, DKIM and DMARC records? Examples
Here is what each record looks like for a domain using Google Workspace. Your DKIM key and any extra senders will differ.
SPF · TXT at northwind.io
v=spf1 include:_spf.google.com ~allDKIM · TXT at google._domainkey.northwind.io (key shortened)
v=DKIM1; k=rsa; p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA…DKIM on Microsoft 365 · two CNAMEs (values come from the Defender portal)
selector1._domainkey CNAME selector1-northwind-io._domainkey.northwindco.n-v1.dkim.mail.microsoft
selector2._domainkey CNAME selector2-northwind-io._domainkey.northwindco.n-v1.dkim.mail.microsoftDMARC · TXT at _dmarc.northwind.io
v=DMARC1; p=quarantine; rua=mailto:[email protected]Step-by-step setup for each: the Google Workspace SPF record, the DKIM setup guide and the DMARC generator.
Common confusions
DKIM vs DMARC, and DKIM vs SPF
DKIM vs DMARC
DKIM is a check; DMARC is a policy. DKIM answers “was this signed by the domain in d=?” DMARC asks whether that domain is the one in the From address, and if not, whether SPF can vouch instead. Only DMARC lets you tell receivers to quarantine or reject failures, and only DMARC sends you reports.
DKIM vs SPF
SPF authorizes servers by IP address and is limited to 10 DNS lookups per check, so a domain with many sending services can run out. DKIM authenticates the message itself with a key you publish, so it keeps working when mail is forwarded, as long as nobody edits it. Most mailbox providers sign DKIM for you once you publish the key.
All three records, published for you
Setup order
Set them up in this order
Each record depends on the one before it. Publishing DMARC first just produces reports full of failures.
Step 1
SPF
One TXT record at the root listing every service that sends as you.
Step 2
DKIM
Generate a key in your mail provider, publish it, turn signing on.
Step 3
DMARC p=none
Publish with a rua address and read the reports.
Step 4
Enforce
Move to quarantine, then reject, once every sender passes.
Check all three at once with the free SPF, DKIM and DMARC checker.
Sources: RFC 7208 (SPF) · RFC 6376 (DKIM) · RFC 9989 (DMARC) · Google email sender guidelines · Yahoo sender best practices · Microsoft: Outlook.com 550 5.7.515 · Microsoft: DKIM for custom domains
Get a free DNS audit
Tell us where to send it. We'll reply with mailbox, domain and DNS recommendations for your sending volume — or start right away and have mailboxes live in minutes.
Where should we send it?
Or see pricing →Frequently asked questions
What is the difference between SPF, DKIM and DMARC?
SPF lists the servers allowed to send for a domain. DKIM adds a cryptographic signature that proves the message came from the domain and wasn't changed. DMARC checks that SPF or DKIM passed for the same domain as the visible From address, and tells receivers what to do when they don't.
DKIM vs DMARC: do I need both?
Yes. DMARC has nothing to evaluate without SPF or DKIM, and DKIM alone doesn't tell receivers what to do with mail that fails. DKIM is usually the check DMARC relies on, because it survives forwarding and SPF doesn't.
DKIM vs SPF: which one matters more?
You need both. Gmail and Yahoo require SPF or DKIM from every sender and both from bulk senders. SPF breaks when mail is forwarded; DKIM usually doesn't, so DKIM is the more robust of the two for DMARC.
What are SPF, DKIM and DMARC records?
They are DNS records. SPF is a TXT record at your root domain starting v=spf1. DKIM is a TXT record at selector._domainkey holding a public key (Microsoft 365 uses two CNAME records instead). DMARC is a TXT record at _dmarc starting v=DMARC1.
Can I use DMARC without SPF or DKIM?
You can publish the record, but every message will fail DMARC, because DMARC only passes when SPF or DKIM passes for an aligned domain. Set up SPF and DKIM first.
In what order should I set up SPF, DKIM and DMARC?
SPF first, then DKIM, then DMARC with p=none and a reporting address. Once the reports show all your real senders passing, move the DMARC policy to quarantine and then reject.