SPF, DKIM and DMARC Explained: How Email Proves Who Sent It

The 30-second explanation

Anyone can type any address into the From line of an email. Email was built that way, and it is why spoofed messages are so easy to send. SPF, DKIM and DMARC are the checks added later to fix it. SPF is a list of the servers allowed to send mail for a domain. DKIM is a digital seal that shows a message was signed by that domain and not changed on the way. DMARC tells the receiving server what to do when those checks fail, and sends the domain owner a report about it.

How it works

1. 1

   1. Arrival

   A message arrives claiming to come from a domain, such as yourcompany.com.

2. 2

   2. SPF

   The receiving server checks whether the server that delivered it is listed in that domain's SPF record in DNS.

3. 3

   3. DKIM

   It also checks the message's digital signature against the public key the domain publishes in DNS.

4. 4

   4. DMARC

   The domain's DMARC policy says what to do when the checks do not match the visible From address: deliver, send to spam, or reject.

When a message arrives, the receiving server knows two things: which server connected to it, and what the message claims about itself. SPF answers the first. It looks up the sender's domain in DNS and checks whether the connecting server is on the approved list. DKIM answers a different question. The sending server signed the message with a private key, and the receiver checks that signature against the public key the domain publishes, which also shows the content was not altered on the way. Neither check, on its own, looks at the From address a person actually reads. That is the gap DMARC fills. It asks whether the domain that passed SPF or DKIM matches the domain in the visible From line, and if it does not, it follows the owner's policy: deliver anyway, send to spam, or reject. Domains normally start with the policy set to none, which only collects reports. They then fix any legitimate sender that fails and tighten the policy step by step.

Real-world example

How to spot it

• No DMARC record

  Looking up the TXT record at _dmarc.yourdomain.com returns nothing, so receivers have no instruction for spoofed mail.

• DMARC stuck on p=none

  A policy of none only monitors. It stops nothing, and many domains never move past it.

• Broken SPF

  More than one SPF record, or a record that needs more than 10 DNS lookups, makes checks fail unpredictably.

• Legitimate mail landing in spam

  A newsletter or invoicing tool that sends as your domain without being in SPF or signing with DKIM gets flagged as soon as enforcement starts.

What to do

1. 1Set up SPF and DKIM for every service that sends as your domain, such as your mail provider, newsletter tool and billing system, then publish a DMARC record at p=none with a reporting address.
2. 2Read the DMARC reports for a few weeks, fix legitimate senders that fail, then move to quarantine and finally reject.
3. 3Remember that these checks protect your exact domain only. Lookalike domains and hijacked mailboxes still get through, so keep teaching people to check the address and the request.