SPF vs DKIM vs DMARC: How Email Authentication Works
SPF, DKIM and DMARC work together to protect your domain from email spoofing and phishing. This guide explains what each one does and why you need all three.
ProfitTool Team
Security & Dev
Why Email Is Easy to Forge
SMTP — the protocol that carries email — was designed in 1982 with no authentication. Any server can claim to send email from any address. SPF, DKIM and DMARC are the three DNS-based standards that fix this, each addressing a different layer of the problem.
SPF — Who Can Send
Sender Policy Framework lets a domain publish a list of authorised sending IP addresses in DNS. When a receiving server gets a message, it checks whether the sending server's IP is on that list.
- Validates: the envelope sender (SMTP MAIL FROM)
- Does not validate: the visible From header in the email client
- Limitation: breaks when email is forwarded (the forwarding server's IP is not on the original SPF list)
DKIM — Was It Tampered With
DomainKeys Identified Mail adds a cryptographic signature to outgoing emails. The sending server signs specific headers and the message body using a private key. The public key is published in DNS. Receiving servers verify the signature.
- Validates: message integrity and that the signing domain sent it
- Survives forwarding (the signature travels with the message)
- Does not validate: the visible From header directly
DMARC — Do They Align, and What Should Happen
Domain-based Message Authentication, Reporting and Conformance ties SPF and DKIM together and adds policy enforcement. DMARC requires that at least one of SPF or DKIM aligns with the visible From domain — not just any domain.
DMARC also tells receiving servers what to do with failing messages:
p=none— monitor only, deliver everythingp=quarantine— send failing messages to spamp=reject— reject failing messages outright
And it provides reporting — aggregate (rua) and forensic (ruf) reports sent back to you so you can see who is sending email as your domain.
The Correct Setup Order
- Add SPF record
- Configure DKIM signing on your email platform
- Verify both are working
- Add DMARC with
p=noneandruareporting - Review reports for 2–4 weeks
- Gradually move to
p=quarantinethenp=reject
Quick Reference
| Standard | What it checks | Survives forwarding | Prevents spoofing |
|---|---|---|---|
| SPF | Sending server IP | No | Partially |
| DKIM | Message signature | Yes | Partially |
| DMARC | Alignment + policy | Yes | Yes (with reject) |
Check your domain's configuration with our SPF Checker, DKIM Checker and DMARC Checker.
ProfitTool Team
Security & DevWritten and maintained by the ProfitTool team. Where an article references a ProfitTool utility, the behaviour described is the behaviour of the tool on this site — you can open it and check the output yourself.
More from the Knowledge Hub
How to Read and Analyse Email Headers
Email headers contain a complete trace of every server an email passed through. This guide explains how to find headers in major email clients, what to look for, and how to detect spoofing.
Privacy & SecurityWhat Is DMARC and How Do You Set It Up?
DMARC builds on SPF and DKIM to give domain owners control over what happens to unauthenticated email. This guide covers how DMARC works and how to configure it safely.
Privacy & SecurityWhat Is an SPF Record and How Does It Work?
SPF (Sender Policy Framework) records tell receiving mail servers which IP addresses are authorised to send email for your domain. Here is how to read and set one correctly.