In the SPF vs DKIM vs DMARC comparison, SPF lists who may send your email, DKIM signs each message, and DMARC tells receivers what to do when a check fails. You need all three. Together they stop others from faking your domain and help your mail reach the inbox.
SPF vs DKIM vs DMARC at a glance
Each record answers a different question. The table shows them side by side. After it, we explain each one in plain words.
| Record | Question it answers | Where it lives |
|---|---|---|
| SPF | Is this server allowed to send for the domain? | A TXT record on the domain |
| DKIM | Did the domain really sign this message? | A TXT record under a selector name |
| DMARC | What should receivers do if SPF and DKIM fail? | A TXT record at _dmarc |
What SPF does
An SPF record is a list of the servers that may send mail for your domain. A receiving server looks it up and checks the sender against it. The standard is RFC 7208.
A simple record looks like this: "v=spf1 include:_spf.example.com -all". The "-all" at the end says that no other server may send. A domain that sends no mail at all can say so with a record that allows nothing.
What DKIM does
DKIM adds a digital signature to each message. The sending system signs with a private key. The matching public key sits in your DNS, under a name that includes a label called a selector. Receivers use it to check that the message has not changed.
DKIM is defined in RFC 6376. Because the selector is chosen by the sender, an outside tool cannot always tell whether DKIM is set up. That is why most checkers can read SPF and DMARC but only hint at DKIM.
What DMARC does
DMARC sits on top of the other two. It says what to do with mail that fails the checks, and it asks receivers to send you reports. It is defined in RFC 7489.
A policy can be "none", "quarantine" or "reject". Under "none", receivers only report. Under "quarantine", they put failing mail in spam, and under "reject" they refuse it. The reports show who is sending mail in your name, which is very useful.
SPF vs DKIM vs DMARC: which do you need first?
You need all three, but the order matters. Start with the simplest and build up. Here is the path we suggest:
- Set up SPF for every service that sends your mail.
- Turn on DKIM in each of those services.
- Add DMARC with the policy "none" and read the reports for a few weeks.
- Move to "quarantine", and later to "reject", when the reports look clean.
Jumping straight to "reject" can block your own mail. So go step by step.
Why SPF vs DKIM vs DMARC matters to mailbox providers
Large mailbox providers now expect proper records. Google's sender guidelines ask bulk senders to set up SPF, DKIM and DMARC. Even if you send little mail, the same records help your messages avoid the spam folder. So it pays to set them up now, while the list of senders is short.
They also protect your name. Without them, anyone can send mail that looks like it came from you. That is a common trick in phishing.
How to check your own records
You can look at your records in a minute. The Domain Health Check reads the SPF and DMARC records of a name, and it lists the expiry date and the lock status as well. It also shows if the name is on a blocklist.
Run it on your own name first, then on any name you plan to buy. A name with no email records is a warning sign. Our post on registrar vs web host vs DNS provider explains who holds the records. The DNS entry in the glossary covers the basics.
Also think about look-alike names. Criminals register names that resemble yours and send mail from them. SPF and DMARC on your own name do not stop that. The Lookalike Finder lists such names, so you can see which ones exist.
Originally published at namedaemon.com/blog/spf-vs-dkim-vs-dmarc-what-each-one-does/. NameDaemon has 18 free tools for .com names, built on the daily zone file, and the numbers are on the State of .com page.
Top comments (0)