Does SPF Still Matter When DKIM Is Working?

DKIM can keep a message passing DMARC, but it does not fix an SPF lookup-limit error or replace every provider’s SPF requirements.

A message can pass DMARC through DKIM even when SPF fails. That gives email more than one way to authenticate, but it does not make every SPF failure harmless.

The reason for the failure matters. An automatic forward can produce an expected SPF failure. A direct message hitting the lookup limit has a different problem.

SPF checks the server; DKIM checks the message

SPF checks whether the sending IP address is authorised by the message’s return-address domain. That domain can differ from the From address the recipient sees.

DKIM adds a signature to the message. The receiver verifies that signature using the signing domain’s published key.

DMARC connects these checks to the visible From address. It passes when either SPF passes with an aligned domain, or a valid DKIM signature uses an aligned domain. Both do not have to pass for DMARC itself to pass. DMARC standard

Either aligned check can satisfy DMARC

View full-size image

Read the diagram as text

1. SPF must pass for a domain aligned with the visible From address for its result to count towards DMARC.
2. Alternatively, a valid DKIM signature can pass for an aligned signing domain.
3. Either qualifying result can satisfy DMARC. Both are not required by DMARC's own pass rule.

Forwarding and lookup errors need different responses

An automatic forward sends the message onward from a different server. That server may not be authorised by the original return-address domain, so SPF can fail. If an aligned DKIM signature survives, DMARC can still pass.

A lookup-limit error is different. SPF cannot complete the necessary evaluation within its ten-lookup allowance. A working DKIM signature does not shorten that check.

SPF flattening addresses the lookup problem by replacing supported references with explicit IP addresses or ranges. Those IP entries do not use the lookup allowance. Automatic refresh keeps the flattened addresses current as providers change them. SPF lookup rules

Flattening does not resolve the change of sending identity caused by forwarding.

Receiving providers can require both

DMARC’s pass rule is not the whole of a receiving provider’s sender policy.

Google requires SPF or DKIM for senders to personal Gmail accounts, and both SPF and DKIM, along with DMARC, for bulk senders. Its bulk-sender requirements also address alignment. Google’s sender requirements and sender FAQ

Microsoft’s requirements for high-volume senders to Outlook.com likewise include passing SPF and DKIM checks, plus DMARC. Microsoft’s announcement

Read a result that passes through DKIM

These fictional authentication results describe a message whose SPF check could not complete:

Authentication-Results: mx.example.net;
  spf=permerror smtp.mailfrom=bounce.example.com;
  dkim=pass header.d=example.com;
  dmarc=pass header.from=example.com

DKIM passes for the same domain as the visible From address, so it can satisfy DMARC. The SPF permanent error still needs investigating; this header does not say whether its cause was syntax, lookup limits or something else.

Open the full message headers and inspect the results added by the receiving service you trust. The email header analyser helps separate those fields, and the alignment guide explains how the domains relate.

Fix the record the message actually uses

Before changing SPF, establish which return-address domain the message used. Some email services use their own domain for that purpose. Editing your main domain’s SPF would not change the result for those messages.

Working DKIM is valuable evidence that one authentication route succeeded. It does not explain an SPF error or show whether the message meets the receiver’s other requirements.