SPF vs DKIM vs DMARC

Cloud

SPF is a DNS list of hosts allowed to send for a domain. DKIM is a signature on the message. DMARC ties those results to the visible From address and states a preference for failure, plus a place to send reports. All three are records and keys, not a filter inside the mailbox. Novatelia scopes them with DNS administration and business email.

Revised 2026-10-10. Published by Novatelia. No individual author is named, because no personal credential is claimed for this explanation.

Key points

SPF breaks when the include list or the lookup limit is ignored.
DKIM survives forwarding better than SPF.
DMARC is the policy that makes the other two actionable.

Definition

Use SPF to name senders, DKIM to sign mail those senders emit, and DMARC to tell receivers whether a failure matters. One record does not replace the other two.

How it works

Each legitimate sender is added to SPF and given a DKIM key. DMARC is published in reporting mode. Reports show who else is sending. Only then is a stricter policy considered. A new marketing tool repeats the same steps.

Architecture

Sender inventory, including applications and newsletters.
SPF and a DKIM key per sender that needs one.
DMARC at the organizational domain, with a report mailbox someone reads.

Use cases

Mail from an application is failing at the receiver.
A domain has SPF and still has no policy for failures.
Forwarded mail fails SPF and needs a signature to survive.

Comparison

SPF: Which hosts may send. Checked against the bounce address path.
DKIM: A signature over selected headers and the body.
DMARC: Alignment with the visible From domain, plus a published preference.

Selection guidance

Do not publish DMARC reject on day one.
Give someone the report mailbox.
Separate transactional senders from mailbox users so an application key is not a person’s password.

Questions

Is one of the three enough?

No. SPF without DKIM fails more often after forwarding. DKIM without DMARC does not publish a domain policy. DMARC without the other two has nothing to align.

Where should a new sender be added?

On the domain and DNS service, against the business-email design. Transactional email is a different solution from a staff mailbox.

More in Cloud

This page defines a term so a project can be scoped. It is not a certification, a test result, or a price. Partnerships are stated only on the partners page. The published address and telephone are the company contact, not a service-level commitment.

Describe the requirement

An RFQ saves a browser draft. It does not publish a price or issue a quotation reference.