emailmetry
All guides

SPF, DKIM and DMARC

Emailmetry guideReviewed

These three checks help a receiving mail server authenticate email. SPF checks the sending server, DKIM checks a digital signature, and DMARC connects a passing result to the domain in the From address.

SummaryDMARC needs a passing SPF or DKIM result that aligns with the visible From domain. A pass for an unrelated domain is not enough.

In this guide

Three checks, different jobs

SPF stands for Sender Policy Framework, DKIM for DomainKeys Identified Mail, and DMARC for Domain-based Message Authentication, Reporting, and Conformance.

SPF

Checks whether the sending server is allowed to send for the envelope-sender domain, which is used for bounced mail.

DKIM

Checks a domain’s digital signature to verify that the signed parts of a message have not changed.

DMARC

Checks whether a passing SPF or DKIM result aligns with the domain in the visible From address.

SPF uses the sending server’s IP address and a record in DNS. DKIM uses a public key in DNS to verify the signature added by the sending service. A correctly authenticated email can still contain harmful content; these checks establish use of a domain, not whether its sender is trustworthy. Microsoft’s email authentication overview and DKIM standard.

DMARC adds domain alignment

An SPF or DKIM pass for an unrelated domain is not enough to pass DMARC. At least one passing result must align with the domain in the From address. With relaxed alignment, the domains must share the same organisational domain. Strict alignment requires an exact match.

DMARC also lets you request reports and specify how you would like receivers to handle mail that fails. The receiving server makes the final handling decision. DMARC standard, identifier alignment.

Visible From: hello@studio.example
Envelope sender: bounce@mailer.example
DKIM signing domain: studio.example
Example domains showing how alignment works.

Here, SPF can pass for mailer.example without aligning with studio.example. A passing DKIM signature for studio.example does align, allowing DMARC to pass. Check the domain next to each result as well as whether it says “pass”.

Set up each sending service

  1. Check its sending domains. Find the envelope-sender and DKIM signing domains in the provider’s setup instructions.
  2. Configure SPF and DKIM. Use the DNS names and values supplied for your account.
  3. Send a test message. Inspect its SPF, DKIM and DMARC results and check the domains they refer to.
  4. Review DMARC reports before enforcing a policy. Fix legitimate mail that fails authentication or alignment before asking receivers to quarantine or reject failures.

The DMARC domain-owner guidance explains how to monitor results and correct problems before enforcement.

Download email service list template (CSV). It has columns for the From, envelope-sender and DKIM signing domains.

Authentication does not guarantee inbox delivery

Receivers also consider sender reputation, message content and their own filtering rules. Forwarding and mailing lists can affect authentication, so include them in your tests if you use them. Microsoft’s guidance on email authentication.

Where Emailmetry helps

Emailmetry keeps SPF up to date as your chosen providers change their sending servers. Add your domain and the DNS record we provide to get started. Your email providers handle DKIM signing; configure DKIM and DMARC alongside SPF.

See how Emailmetry works, or use the guide to changing email providers when switching services.