SPF, DKIM and DMARC are separate email-authentication controls that solve different parts of the same problem: helping receiving mail systems decide whether a message claiming to come from your domain is legitimate.
SPF authorises sending infrastructure, DKIM adds a cryptographic signature that can be verified with a public key in DNS, and DMARC connects those results to the domain visible in the message's From address.
Sender Policy Framework (SPF) lets a domain publish which mail servers or services are authorised to send on its behalf. A receiving server compares the message's envelope sender domain with the SPF policy published in DNS.
SPF is useful, but it does not authenticate the visible From address by itself and it does not sign message content. Forwarding can also cause SPF to fail when the forwarder is not included in the original sender's authorised infrastructure.
DomainKeys Identified Mail (DKIM) adds a cryptographic signature to a message. The signing service uses a private key, while the receiving system retrieves the corresponding public key from DNS using a selector.
A valid DKIM signature can survive some forwarding scenarios where SPF does not, provided the signed parts of the message are not modified in a way that invalidates the signature.
DMARC checks whether the domain visible to the recipient aligns with an authenticated SPF domain or an authenticated DKIM signing domain. It also lets a domain publish a policy and reporting instructions.
A message can satisfy DMARC through aligned SPF OR aligned DKIM. Both mechanisms do not have to pass. Many organisations deploy both so there is more than one path to successful authentication.
Together, SPF, DKIM and DMARC give receiving systems stronger evidence about authorised mail and give domain owners more visibility into legitimate and unauthorised sending sources.
They reduce spoofing risk but do not make phishing or impersonation impossible. Email authentication should be treated as one layer of a broader security program.
Use the matching ScoutLab checker with only a domain name. No signup or email address is required.
ThreatScout can externally observe public SPF, DKIM and DMARC records and policy signals as part of the free website security scan. It does not change your DNS or email configuration.
Run the free website security checkFor a business domain that sends email, using all three is a strong baseline because they provide complementary controls. SPF authorises sending infrastructure, DKIM signs messages, and DMARC evaluates alignment and policy. The exact deployment should reflect the services that legitimately send mail for your domain.
No. DMARC can pass when either SPF passes with alignment or DKIM passes with alignment. Deploying both is still useful because it creates more than one authentication path and can make legitimate mail more resilient to forwarding or infrastructure changes.
No. Correct email authentication materially reduces some forms of direct domain spoofing, but attackers can use lookalike domains, compromised accounts or other techniques. Authentication is an important control, not a guarantee that every deceptive message will be blocked.
SPF, DKIM and DMARC are domain-level email-authentication controls. They reduce specific spoofing risks but do not replace mailbox security, phishing controls, account protection or broader cyber security measures.
