Does SPF Still Matter When DKIM Is Working?

Working aligned DKIM can satisfy DMARC without an SPF pass, but some mailbox-provider requirements separately call for both. Check SPF for the domain the service actually uses. Configure the record when that domain belongs to you; the provider maintains its own domain's policy. Not every service needs adding to root SPF.

There are two different questions here: can DKIM alone satisfy DMARC, and does your sending arrangement need working SPF? The first has a simple answer. The second depends on the route and the receiving provider's requirements.

DMARC has an either-or path to a pass

DMARC can pass when either SPF or DKIM passes with the required alignment to the visible From domain. A DKIM signature for an unrelated provider domain does not satisfy that relationship merely because the signature is valid. RFC 9989 defines DMARC's alignment rules.

That makes SPF fail, DKIM pass and DMARC pass a valid combination. Forwarding is one situation where it can be expected: the connecting server changes while the original aligned DKIM signature survives.

A known forwarded path producing that result does not automatically need another DNS change or an investigation every time it occurs. An unexpected failure on a direct sending route is a different matter.

Mailbox providers can require both methods

Google requires SPF or DKIM for general senders to personal Gmail accounts, and SPF, DKIM and DMARC for bulk senders. Those are requirements beyond DMARC's either-or rule. Google publishes the current requirements.

Its FAQ counts messages from subdomains with the primary domain for bulk-sender classification and describes the threshold as close to 5,000 messages or more in 24 hours. These rules concern personal Gmail recipients, not all Google Workspace inbound mail. The FAQ explains the scope.

Microsoft likewise requires SPF and DKIM to pass for high-volume senders to Outlook.com and related consumer services, with DMARC alignment through at least one method. Its 550 5.7.515 support article describes the classification and rejection.

A DMARC pass does not override a receiver's other requirements or guarantee inbox placement.

The relevant SPF record may belong to the provider

Suppose a delivery service sends using its own envelope domain and signs DKIM with your business domain. SPF can pass for the provider's domain while aligned DKIM supplies the DMARC pass. Adding that service to your root SPF would not change the SPF result for the provider's envelope domain.

If you enable a custom envelope domain, that changes which policy needs configuring. The provider's current account settings and a message's authentication results identify the actual arrangement.

Working DKIM is therefore no reason to remove SPF records needed by your staff mailbox or other direct senders. Equally, it is no reason to add irrelevant includes just to make a DNS checklist look complete.

Configure the methods your sending and receiving services require, and verify the intended alignment. Our SPF pass with DMARC failure article explains the reverse case: an SPF pass for the wrong identity cannot satisfy DMARC.