# SPF, DKIM and DMARC Explained: How Email Authentication Works

> SPF is a DNS record that lists the servers allowed to send mail for a domain. DKIM adds a cryptographic signature to each message that receivers verify using a public key in DNS. DMARC builds on both: it tells receivers what to do with mail that fails authentication, and where to send reports.

## SPF: who may send

The Sender Policy Framework ([RFC 7208](https://www.rfc-editor.org/rfc/rfc7208)) is a TXT record at your domain that starts with `v=spf1`. It lists the servers and services allowed to send mail using your domain in the envelope sender.

| Ending | Meaning |
| --- | --- |
| -all | Hard fail: anything not listed should be rejected. |
| ~all | Soft fail: anything not listed is suspicious but may be accepted. |
| ?all | Neutral: no assertion. |
| +all | Allows everyone. Avoid it. |

A domain may publish only one SPF record, and evaluating it may cause at most ten DNS lookups.

## DKIM: a signature on every message

DomainKeys Identified Mail ([RFC 6376](https://www.rfc-editor.org/rfc/rfc6376)) signs selected headers and the body. The sending system adds a `DKIM-Signature` header that names a selector. The receiver fetches the public key from a TXT record at `selector._domainkey.yourdomain` and checks the signature. Selectors let you run several keys and rotate them.

## DMARC: the policy and the reports

DMARC ([RFC 7489](https://www.rfc-editor.org/rfc/rfc7489)) is a TXT record at `_dmarc.yourdomain`. Its key tags are:

- `p=` the policy for mail that fails: `none`, `quarantine` or `reject`.

- `rua=` where receivers send aggregate reports.

- `adkim=` and `aspf=` how strictly the domains must align.

DMARC passes when SPF or DKIM passes *and* the authenticated domain aligns with the visible From domain.

## How they work together

|  | Answers | Lives at |
| --- | --- | --- |
| SPF | Is this server allowed to send for the domain? | TXT at the domain |
| DKIM | Was this message signed, and unchanged? | TXT at selector._domainkey |
| DMARC | What should receivers do if both fail to align? | TXT at _dmarc |

## Common mistakes

- Publishing two SPF records instead of one.

- Exceeding the ten-lookup limit by chaining many includes.

- Forgetting a third-party sender such as a marketing or support platform.

- Publishing DMARC with `p=none` and never reading the reports.

- Jumping to `p=reject` before every legitimate sender is aligned.

## Questions

**Do I need SPF, DKIM and DMARC all together?**
Yes. DMARC needs SPF or DKIM to pass with alignment, and having both gives resilience when one breaks, for example when a message is forwarded.

**What DMARC policy should I use?**
Start at p=none with a reporting address, read the reports, fix every legitimate sender, then move to quarantine and finally reject.

**Can I check my records without sending mail?**
Yes. SPF, DKIM and DMARC are all published in DNS, so they can be read without sending any message.

Tool: [Check a domain's SPF, DMARC and MX](https://www.emcheq.com/tools/dmarc-checker)