SPF and DMARC only work properly if the sending domains and sources are consistent. Too strict a policy published too soon can block legitimate messages.
Role of each mechanism
| Mechanism | Function |
|---|---|
| SPF | Allows servers that can send for the envelope domain. |
| DKIM | Sign the message with a domain key. |
| DMARC | Checks alignment with the visible domain in From address and publishes a policy. |
To understand their complementarity before changing the DNS, see differences between SPF, DKIM and DMARC.
Careful deployment
- Invent all services that send messages.
- Validate SPF and DKIM for each flow.
- Start DMARC with
p=noneand a functional reporting address. - Analyze reports before moving gradually to
quarantinethen possiblyreject.
Field passive audit
DomainCheck verifies public data without authentication, vulnerability exploitation and message sending.
Check my domain Create my Protect spaceAttention
There should normally be only one registration SPF by name. Audit DKIM complete requires to know the selector used. A DNS success also does not guarantee that all real flows are aligned.
For a detailed implementation, see the guide SPF, DKIM and DMARC OVH.
Updated on 20 August 2026.