In short
SPF lists the servers allowed to send for your domain, DKIM signs each message with a key published in DNS, and DMARC checks that at least one of them passes and aligns with the From address. Gmail, Yahoo and Outlook.com require all three from bulk senders, and gov.uk requires them on UK public sector domains.
Want help with SPF, DKIM and DMARC set-up?
We can plan it with you or do it for you. Tell us where you are up to.
SPF in brief: which servers may send
SPF (Sender Policy Framework), defined in RFC 7208 (opens in a new tab), is a TXT record on your domain listing the servers and services allowed to send mail for it. The NCSC (opens in a new tab) describes it as a way "to publish a list of the IP addresses which should be trusted for a given domain". A typical record looks like the NCSC's example: v=spf1 include:_spf.google.com ~all.
Three things trip people up:
- The 10-lookup limit. RFC 7208 section 4.6.4 (opens in a new tab) caps the include, a, mx, ptr and exists mechanisms and the redirect modifier at 10 DNS lookups in total; go over and the result is a permanent error. Each include can carry nested lookups of its own
- What SPF checks. It checks the hidden envelope (Mail From or Return-Path) domain, not the From address people see, which is why DMARC alignment matters
- Forwarding breaks it. A forwarded message arrives from the forwarder's server, which is not in your SPF record (RFC 7208 appendix D (opens in a new tab) discusses the workarounds)
The end of the record matters too: ~all (soft fail) is the minimum gov.uk asks of public sector domains (gov.uk (opens in a new tab)), and RFC 9989 section 7.1 (opens in a new tab) warns that -all can cause some receivers to reject mail on an SPF fail before DMARC is even evaluated. Our sister site has a full guide to the SPF record (opens in a new tab).
DKIM in brief: a signature on every message
DKIM (DomainKeys Identified Mail), defined in RFC 6376 (opens in a new tab), adds a cryptographic signature to each message as it leaves your mail service. The signature names a signing domain (the d= tag) and a selector (the s= tag), and receivers fetch the matching public key from DNS to check it.
The key lives under the _domainkey name. RFC 6376 section 3.6.2.1 gives the pattern: a signature with d=example.com and s=foo.bar is checked against the TXT record at foo.bar._domainkey.example.com. Each sending service usually has its own selector, so a domain might have one for Microsoft 365, one for Google Workspace and one for its marketing platform.
DKIM survives forwarding in a way SPF does not, because the signature travels with the message. RFC 9989 section 7.4 (opens in a new tab) notes that in relay situations "DKIM signatures will generally remain valid". What can break DKIM is a service that changes the message on the way, such as a mailing list adding a footer or a subject tag. More detail is in our sister site's DKIM guide (opens in a new tab).
DMARC on top: alignment and policy (DKIM vs DMARC)
SPF and DKIM each prove that *a* domain handled the message. Neither proves it was *your* domain in the From address: RFC 9989 (opens in a new tab) points out that "a message can bear a valid signature from any domain, even one used by a bad actor", and any domain owner can publish an SPF record for its own domain.
DMARC closes that gap. It asks for an SPF pass or a DKIM pass for a domain aligned with the From address, then applies your policy if neither exists. That is the essential DKIM vs DMARC difference: DKIM is a signing method, while DMARC is the policy and reporting layer that decides what a DKIM (or SPF) result means for your domain.
- DKIM alone: proves the signing domain sent the message unaltered, but says nothing about the From address and asks for no action on failure
- SPF alone: proves the envelope domain allowed the sending server, but the envelope domain is invisible to your recipients
- DMARC with either: ties the passing domain to the visible From address, tells receivers what to do when nothing aligns and sends you reports
The DMARC record explained page shows how relaxed and strict alignment work, with examples.
SPF vs DKIM vs DMARC compared
| SPF | DKIM | DMARC | |
|---|---|---|---|
| What it checks | That the sending server is authorised for the envelope (Mail From) domain | That a signature from the signing (d=) domain is valid and the message is unaltered | That SPF or DKIM passed for a domain aligned with the From address |
| Where it is published | TXT record on the envelope domain, starting v=spf1 | TXT record at selector._domainkey.domain | TXT record at _dmarc.domain, starting v=DMARC1 |
| Who sets it up | You list each sending service | Each sending service signs; you publish its key | You publish one record per domain (or the organisational domain) |
| What commonly breaks it | Forwarding; more than 10 DNS lookups; more than one SPF record | Mailing lists or gateways that change the message; missing or rotated keys | Services that pass SPF or DKIM for their own domain but not yours |
| Policy on failure | ~all or -all, read by the receiver | None of its own | none, quarantine or reject |
| Reports | None | None | Aggregate (rua) and failure (ruf) reports |
| Defined in | RFC 7208 (opens in a new tab) | RFC 6376 (opens in a new tab) | RFC 9989 (opens in a new tab) |
Because each control has a different weak spot, using both SPF and DKIM gives DMARC two chances to find an aligned pass. RFC 9989 says it is "RECOMMENDED that Domain Owners use both DKIM and SPF as underlying authentication mechanisms for DMARC".
Not sure which option applies to you? Ask us
Tell us about your organisation and we will point you to the right option.
The order to set up SPF, DKIM and DMARC
SPF and DKIM come first because DMARC has nothing to check without them: it only passes when one of them passes for a domain aligned with your From address. A DMARC record at p=none can still go in early, because it changes nothing about delivery and its reports show which senders still need SPF or DKIM work. RFC 9989 section 5.1.6 (opens in a new tab) adds that unaligned legitimate streams "MUST be addressed" before a domain moves to an enforcing policy. The full sequence, from listing your senders to enforcement, is in our step-by-step guide to how to set up DMARC.
Managing the SPF lookup limit with hosted SPF
Organisations with many sending services often run out of SPF lookups. Splitting services onto subdomains is one answer: the NCSC notes each subdomain "has its own lookup and character limits". The other is hosted SPF, where a DMARC platform publishes and maintains the record for you. The three platforms we supply each do this differently:
| Service | How it handles the limit | What you publish |
|---|---|---|
| EasySPF (opens in a new tab) (EasyDMARC) | Dynamically flattens your includes into IP ranges and refreshes them when a provider's published SPF data changes | One EasySPF-provided TXT record; senders are then managed in the EasyDMARC dashboard |
| Instant SPF (opens in a new tab) (Valimail) | Uses SPF macros to return only the rules for the service that sent each message, so the full list of senders is not exposed in public DNS (Valimail (opens in a new tab)) | An SPF record with Valimail's macro include, per its set-up guide (opens in a new tab) |
| SPF Management (opens in a new tab) (Check Point) | Uses the SPF macro mechanism, "which allows an unlimited number of SPF entries to be defined"; included in the DMARC Management add-on | An include for your tenant's checkpoint-spf.com host |
Which suits you depends on how many senders you have and whether you want SPF managed in the same place as your DMARC reports. Plan coverage for each is confirmed at quote; see EasyDMARC, Valimail and Check Point DMARC Management.
Prefer a hand with this?
We can help you plan it and set it up, alongside your own team.
Check all three, then get help where you need it
Start by seeing where you stand: the DMARC checker reads your DMARC record and the SPF record it depends on, and explains what each part means.
From there we can help:
- Assess your domains: we review SPF, DKIM and DMARC on every domain you own and list the services sending as you
- Fix SPF and DKIM: we help you align each sending service and keep SPF within its lookup limit
- Choose and supply the platform: we supply EasyDMARC, Valimail and the Check Point Email Security DMARC Management add-on, including their hosted SPF and DKIM options
- Plan your route to enforcement: we help you plan each policy step once your senders pass
Licences can be billed monthly, with terms confirmed at quote. Contact us for free advice.
Frequently asked questions
Do I need SPF, DKIM and DMARC?
Yes, ideally all three. DMARC needs SPF or DKIM to pass for an aligned domain, and RFC 9989 recommends using both so a message has two chances to pass. Gmail, Yahoo and Outlook.com require SPF, DKIM and DMARC from bulk senders, and gov.uk requires all three records on UK public sector domains.
Is DKIM or SPF more important for DMARC?
DKIM is the more robust of the two, because the signature survives forwarding while SPF does not. RFC 9989 goes further for strict policies: domains that publish p=reject "MUST NOT rely solely on SPF" and "MUST apply valid DKIM signatures to their messages". Set up both, but make sure every important sender signs with DKIM.
What is the difference between DKIM and DMARC?
DKIM signs messages so a receiver can check that a named domain sent them unaltered. DMARC is a policy on top: it checks whether the DKIM (or SPF) domain matches the From address your recipients see, tells receivers what to do when it does not, and sends you reports. DKIM without DMARC asks for no action on failure.
What does Google require for SPF, DKIM and DMARC?
Google's email sender guidelines (opens in a new tab) ask every sender to personal Gmail accounts to set up SPF or DKIM. Senders of 5,000 or more messages a day must set up SPF and DKIM and publish DMARC, at p=none or stronger, with the From domain aligned to SPF or DKIM. See DMARC sender requirements.
Can I have more than one SPF record?
No. A domain should publish a single SPF record; more than one gives a permanent error under RFC 7208, so receivers treat SPF as broken. Combine every service into one record, keeping within the 10-lookup limit, or use a hosted SPF service such as EasySPF, Valimail Instant SPF or Check Point SPF Management.
Why does my email pass SPF and DKIM but fail DMARC?
Because the passing domains are not aligned with your From address. A service can pass SPF for its own bounce domain and sign DKIM with its own domain, so both checks pass, but neither matches your domain. Set the service up with a custom bounce domain or DKIM signing for your domain. See DMARC fail.
Still have a question about SPF, DKIM and DMARC set-up?
Ask us and a member of our team will get back to you.