Fundamentals
Email Authentication Explained: SPF, DKIM, and DMARC
Understanding how the three pillars of email authentication work together to protect your domain.
Email authentication is a set of techniques used to verify that an email message actually comes from the domain it claims to be from. Without these protocols, anyone can send emails pretending to be your organization—a technique known as email spoofing.
The problem: By default, email has no built-in way to verify sender identity. This makes it trivially easy for attackers to impersonate your brand in phishing attacks.
SPF: Sender Policy Framework
What it does:
SPF specifies which IP addresses and mail servers are authorized to send email on behalf of your domain.
How SPF Works
- You publish a TXT record in DNS listing authorized senders
- When someone receives an email "from" your domain, they check your SPF record
- The receiving server compares the sending IP against your authorized list
- If the IP isn't authorized, the email fails SPF
Example SPF Record
This record authorizes Google Workspace and SendGrid to send email for the domain.
DKIM: DomainKeys Identified Mail
What it does:
DKIM adds a cryptographic signature to outgoing emails, allowing recipients to verify the message wasn't tampered with in transit.
How DKIM Works
- Your mail server signs outgoing emails with a private key
- You publish the corresponding public key in DNS
- Receiving servers retrieve your public key and verify the signature
- If the signature is valid, the email passes DKIM
Example DKIM Record
The selector (google) identifies which key to use. Large organizations often have multiple DKIM keys.
DMARC: Domain-based Message Authentication, Reporting & Conformance
What it does:
DMARC builds on SPF and DKIM by adding alignment requirements and telling receivers what to do when authentication fails.
How DMARC Works
- DMARC requires either SPF or DKIM to pass AND align with the From domain
- You specify a policy: none (monitor), quarantine (spam), or reject (block)
- Receivers send you reports about authentication results
- You gain visibility into who's sending email as your domain
Example DMARC Record
How They Work Together
Email is sent
Server signs with DKIM, SPF record lists authorized IPs
Receiving server checks SPF
Is the sending IP authorized for this domain?
Receiving server checks DKIM
Does the signature match the public key in DNS?
DMARC evaluates alignment
Do the authenticated domains match the From header?
Action taken based on DMARC policy
None, quarantine, or reject based on your configuration
Why You Need All Three
SPF Alone
❌ Doesn't verify message integrity
❌ No visibility into failures
❌ Breaks with forwarding
DKIM Alone
❌ No policy for failures
❌ No reporting mechanism
❌ Complex key management
SPF + DKIM + DMARC
✅ Complete authentication
✅ Policy enforcement
✅ Visibility & reporting
Check Your Email Authentication
Use our free tools to verify your SPF, DKIM, and DMARC records are properly configured.