SPF, DKIM, and DMARC: The Email Authentication Basics

Email authentication helps receiving systems check whether a message is authorized to use your domain. The three standards most teams encounter are SPF, DKIM, and DMARC. They work together, but each answers a different question.

SPF: which systems may send?

Sender Policy Framework (SPF) is a DNS record that lists the mail servers permitted to send for a domain. Keep the record aligned with the services you actually use, and review it when your sending setup changes.

DKIM: was the message signed?

DomainKeys Identified Mail (DKIM) adds a cryptographic signature to outgoing messages. Receiving systems can use the public key published in DNS to verify that the signature matches the domain and that signed parts of the message were not altered in transit.

DMARC: what should receivers do with failures?

Domain-based Message Authentication, Reporting, and Conformance (DMARC) lets a domain owner publish a policy for messages that fail authentication alignment. It can also provide reports that help teams understand how their domain is being used.

Roll out changes carefully

Inventory every legitimate sending service before changing DNS. Start with a monitoring-focused DMARC policy, review reports, and tighten enforcement only after you understand the results. DNS changes can take time to propagate, so verify records from multiple resolvers and test real messages after updates.

Authentication is one part of deliverability. Relevant content, healthy list practices, and recipient feedback still matter.