Skip to content
man glossary/spf-dkim-dmarc

glossary define spf-dkim-dmarc

Name

SPF, DKIM and DMARC

Three DNS-based email authentication standards that list authorised senders, sign messages and set a policy for failures, guarding inbox placement.

Synopsis

SPF DKIM DMARC, Email authentication, DMARC policy, DKIM signature, SPF record

Section

CPaaS & channels

Level

practitioner

▍

Reviewed

Change one character: does the DKIM body hash hold?

3 / 3

Incoming request

As signed

POST /webhook HTTP/1.1

DKIM-Signature bh: 3a5b6278a72546448051bd68f221c2befb68eee00ae48eadba2b3f4e7d1086ad

116 bytes, exactly as the sender signed them.

Your server verifies

  1. Read the raw body and the headerUse the exact bytes received — 116 bytes, before any JSON parsing.
  2. Hash what arrivedSHA-256(raw body)
  3. Compare the two digestsEqual digests mean equal bytes.
No secret involved — anyone can compute it.

DKIM-Signature bh (received) vs SHA-256(raw body) (computed)

Received3a5b6278a72546448051bd68f221c2befb68eee00ae48eadba2b3f4e7d1086ad
Computed3a5b6278a72546448051bd68f221c2befb68eee00ae48eadba2b3f4e7d1086ad
Match — bytes arrived intactThe digest proves nothing changed in transit (but not who sent it).
DKIM's bh= tag is a plain SHA-256 of the body (hex here, base64 in real mail). Tamper with the body and the hash breaks; let the attacker rehash and it matches again, which is why DKIM also signs it with the domain's private key.

Match — bytes arrived intact. The digest proves nothing changed in transit (but not who sent it).

Description

What is SPF, DKIM and DMARC email authentication?

SPF, DKIM and DMARC are the three standards that let a receiving mail server check whether an email really comes from the domain it claims. All three are published as TXT records in the sending domain's DNS, and all three are checked on arrival after SMTP has handed the message over. SMTP itself lets any client claim any sender; these records are how a domain owner says which mail is genuinely theirs.

Sender Policy Framework (SPF, RFC 7208) lists the servers allowed to send for a domain, for example v=spf1 ip4:203.0.113.10 include:_spf.mailer.example -all. The receiver checks the connecting server's IP against the record of the envelope sender's domain (the MAIL FROM, later the Return-Path). DomainKeys Identified Mail (DKIM, RFC 6376) adds a DKIM-Signature header: the sender hashes the body into bh=, signs that and selected headers with a private key into b=, and publishes the public key at selector._domainkey.domain, so any receiver can verify the message was not altered and was signed by the domain in d=.

Domain-based Message Authentication, Reporting and Conformance (DMARC, RFC 7489) ties the two to the address people actually see. A message passes DMARC when SPF or DKIM passes for a domain that aligns with the From: header domain, and the record at _dmarc.domain tells receivers what to do otherwise (p=none, quarantine or reject) and where to send aggregate reports (rua=). Unlike the HMAC signature on a webhook, which relies on a secret shared by two parties, DKIM uses public-key cryptography, so millions of receivers can verify without ever holding a secret.

Key takeaways

  • SPF lists which servers may send for a domain, DKIM signs each message with the domain's key, and DMARC says what to do when both fail.
  • DMARC passes only when SPF or DKIM passes for a domain that aligns with the visible From: address.
  • All three live in DNS as TXT records: on the domain, at selector._domainkey and at _dmarc.
  • Roll out DMARC with p=none and reports first, fix every legitimate source, then move to quarantine and reject.
  • Since 2024 major mailbox providers require SPF, DKIM and DMARC from bulk senders, so missing records now cost inbox placement.

Usage

SPF, DKIM and DMARC email authentication in code

; SPF: servers allowed to send for the envelope domain
bounce.shop.example.            TXT  "v=spf1 ip4:203.0.113.10 include:_spf.mailer.example -all"
 
; DKIM: public key for selector s2026 (private key stays on the signer)
s2026._domainkey.shop.example.  TXT  "v=DKIM1; k=rsa; p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA..."
 
; DMARC: policy and reports for the From: domain
_dmarc.shop.example.            TXT  "v=DMARC1; p=quarantine; rua=mailto:dmarc-reports@shop.example; adkim=r; aspf=r"

Relaxed alignment (adkim=r, aspf=r) lets bounce.shop.example align with shop.example.

Mechanics

How does SPF, DKIM and DMARC email authentication work?

  1. step 1 — Publish SPF for the envelope domain

    One TXT record per domain listing your servers and providers, ending in -all (fail) or ~all (softfail). Keep it under SPF's limit of 10 DNS lookups across include, a, mx, exists and redirect, or it returns a permanent error.

  2. step 2 — Sign every message with DKIM

    Each sending service signs with its own selector and a 2048-bit RSA key whose public half you publish at selector._domainkey.yourdomain. Rotate keys by adding a new selector before retiring the old one.

  3. step 3 — Start DMARC in monitoring mode

    Publish v=DMARC1; p=none; rua=mailto:… and read the aggregate reports. They list every IP sending as your domain and whether it passed SPF, DKIM and alignment.

  4. step 4 — Fix alignment for each legitimate source

    Make every tool that sends as you (CRM, billing, support desk) either sign with DKIM using your domain or use an envelope domain under yours, so its mail aligns with the From: address.

  5. step 5 — Enforce gradually

    Move to p=quarantine, optionally ramping with pct=, then to p=reject once reports show only known, passing sources. Keep reading reports: new tools appear and keys expire.

Caveats

Common mistakes with SPF, DKIM and DMARC email authentication

  • Publishing two SPF records or too many includes

    A domain may have only one SPF record, and more than 10 DNS lookups makes it a permanent error, which many receivers treat as a fail. Merge records and remove providers you no longer use.

  • Passing SPF and DKIM but failing DMARC

    A tool that signs with its own domain or uses its own bounce address passes authentication for that domain, not yours. Configure custom DKIM and a return-path under your domain so results align.

  • Leaving DMARC at p=none forever

    Monitoring mode protects nobody: spoofed mail is still delivered. Read the reports, fix your sources and move to quarantine and then reject on a schedule.

  • Relying on SPF alone

    SPF breaks when mail is forwarded, because the forwarder's IP is not in your record. DKIM survives forwarding as long as the message is not modified, so sign everything.

Properties

SPF, DKIM and DMARC email authentication: key facts and limits

SPF
RFC 7208 · TXT on the envelope domain · max 10 DNS lookups
DKIM
RFC 6376 · key at selector._domainkey · 2048-bit RSA recommended
DMARC
RFC 7489 · TXT at _dmarc · p=none, quarantine or reject
DMARC pass rule
SPF or DKIM passes and aligns with the From: domain
Reports
Aggregate XML (rua), usually daily, from receiving providers
Bulk-sender rules
Major mailbox providers since Feb 2024; Outlook.com since May 2025

Questions

SPF, DKIM and DMARC FAQs

Do I need all three of SPF, DKIM and DMARC?
Yes, for reliable inbox placement. SPF and DKIM authenticate the sending server and the message, and DMARC links them to your visible From: domain and tells receivers what to do with failures; large mailbox providers now expect all three from bulk senders.
What does DMARC p=none actually do?
It only asks for reports. Receivers apply no special treatment to failing mail, so spoofing still works, but the aggregate reports show who is sending as your domain. Use it as the first step of a rollout, not the end state.
Why does SPF fail when an email is forwarded?
Because the forwarding server sends from its own IP address, which your SPF record does not list. DKIM usually survives forwarding, and DMARC passes if the DKIM signature still aligns, which is why signing every message matters.
How is a DKIM signature different from a webhook HMAC signature?
DKIM uses a private key to sign and a public key in DNS to verify, so anyone can check it. A webhook HMAC such as X-Hub-Signature-256 uses one secret shared by sender and receiver, so only the two parties holding it can create or verify the signature.

Why it matters

Why does SPF, DKIM and DMARC email authentication matter?

Without these records, anyone can send mail that looks like it is from your domain, and real mail from you looks no different from that forgery. Mailbox providers have made authentication a condition of delivery: since February 2024 the largest consumer mail services require SPF and DKIM from bulk senders, plus a DMARC record and alignment, and Outlook.com added similar rules for high-volume senders in May 2025. For a business, that turns three DNS records into the difference between OTP and invoice emails reaching the inbox and disappearing into spam.

Example

Example: A Gurugram travel portal stops spoofed refunds

Customers of a Gurugram travel portal start receiving fake "refund pending" emails from its domain. Its DMARC record has been p=none for two years and nobody reads the reports. The team turns on report processing and finds four genuine sources: the booking engine, the CRM, a support desk and a survey tool that is not signing. After the survey tool gets its own DKIM selector and the CRM moves to a bounce subdomain, reports show 99.6% aligned mail, so the domain goes to p=quarantine for a month and then p=reject. Spoofed messages are now refused at the receiving server.

Notes

Best practices for SPF, DKIM and DMARC email authentication

  • Give each sending service its own DKIM selector so one can be rotated or revoked without touching the others.
  • Send transactional and marketing mail from different subdomains so a campaign problem cannot drag down password resets.
  • Publish p=reject with sp=reject on parked domains that never send mail.
  • Once DMARC is enforced you can add a BIMI record so supporting mail apps show your logo.
  • Watch email bounce and complaint rates beside your DMARC reports: authentication helps deliverability only when the list itself is clean.

See InfiQ pricing

Put SPF, DKIM and DMARC to work

InfiQ is an official Meta Business Partner. Start a 7-day free trial — no card needed — and see this running on your own number.

Start free trialBrowse all 550 terms