SPF, DKIM and DMARC each have a distinct role. SPF checks whether the sending server is authorized. DKIM verifies a domain signature. DMARC requires at least one of these checks to pass and align with the visible From address, then specifies how failures should be handled.
The difference between SPF, DKIM and DMARC in one minute
| Mechanism | What it verifies | What it provides |
|---|---|---|
| SPF | The sending server is authorized for the envelope domain | A list of legitimate sending sources |
| DKIM | The message signature is valid | Proof of integrity associated with a domain |
| DMARC | SPF or DKIM is aligned with the visible domain | Policy and reporting |
Why the visible address is not enough
The "From" field of an e-mail can be falsified, like an address written on an envelope. Without authentication, a fraudster can try to use your domain to send phishing. SPF, DKIM and DMARC give the recipient server technical elements to evaluate the message.
SPF: which servers may send email?
SPF is a DNS record that lists the infrastructure authorized to send email for a domain. The recipient server compares the sender's IP address to this policy.
SPF has an important limitation: it checks the envelope domain used for delivery, which may differ from the domain displayed in the From field. It can also fail after some types of forwarding, so SPF alone is not enough.
DKIM: does the message have a valid signature?
DKIM adds a cryptographic signature to the message headers. The private key remains with the sender, while the public key is published in the DNS. The recipient can verify that the signed parts have not been changed and that the specified domain controls the key.
A valid DKIM signature proves the technical integrity of the signed content; it does not guarantee that the message itself is honest or safe.
DMARC: is the visible domain aligned?
DMARC links SPF and DKIM results to the domain visible to the user. To pass, at least one mechanism must be valid and aligned with that domain. The DMARC policy then tells the recipient whether to monitor, quarantine or reject non-compliant messages.
p=none: monitor without requesting blocking;p=quarantine: request that failing messages be treated as suspicious;p=reject: request rejection of messages that fail.
How the three protections work together
DMARC replaces neither SPF nor DKIM. It interprets their results in relation to the visible From domain. A message can therefore receive spf=pass and still fail DMARC if the authenticated domain is not aligned. The same rule applies to DKIM.
The most robust configuration publishes one complete SPF policy, enables DKIM for every sending source, and deploys DMARC gradually after reviewing reports.
Most frequent errors
- publish several SPF records instead of a single policy;
- forget a service that sends invoices, forms or newsletters;
- enable DKIM without checking which domain is actually used to sign;
- move directly to
p=rejectwithout analyzing DMARC reports; - confuse domain authentication with protection against every malicious message.
Check and monitor domain protections
DomainCheck checks public SPF, DMARC, MX and DNS settings. TechAtelier Protect then keeps a history and tracks domain alerts over time.
Audit my domain Create my Protect accountThe right approach
Start by inventorying all legitimate senders. Configure SPF and DKIM, publish DMARC, then check real messages and the reports you receive. Strengthen the policy only after correcting forgotten sources.
Use the page Check DMARC and SPF for a domain, then follow the tutorial for Configure SPF, DKIM and DMARC at OVHcloud.
To determine the order of intervention when a check fails, see how to prioritize a domain alert. See related content in the Domains and monitoring category.
Frequently Asked Questions
What is the difference between SPF, DKIM and DMARC?
SPF authorizes sending servers, DKIM signs messages, and DMARC checks alignment with the visible From domain while publishing a handling policy.
Should the three mechanisms be configured together?
Yes. SPF and DKIM provide the authentication results that DMARC relies on. Using all three also makes legitimate email flows easier to diagnose.
Can DMARC pass when only SPF is valid?
Yes, if SPF passes and aligns with the visible From domain. A valid, aligned DKIM signature can also make DMARC pass.
Which DMARC policy should you start with?
Usually, start with p=none and a working reporting address. Strengthen the policy only after identifying all legitimate senders.
Published on August 2, 2026 ยท updated on August 20, 2026.