Email security
SPF vs DKIM vs DMARC: What Each Does
By PixelPrivate Security Team · Published · Updated · 6 min read
Short answer: SPF lists which servers may send for your domain, DKIM signs messages so receivers can verify them, and DMARC ties both to the visible From address and tells receivers what to do with failures. You need all three.
The short version
Think of SPF as a guest list, DKIM as a tamper-proof seal, and DMARC as the instruction to the doorman about what to do when the list or the seal does not check out.
Comparison
SPF checks the sending server’s IP against your published list. It can break when mail is forwarded. DKIM checks a cryptographic signature and usually survives forwarding. DMARC passes only if SPF or DKIM passes and aligns with the From domain.
What none of them do
- They do not stop lookalike domains such as yourcompany-billing.com.
- They do not encrypt email.
- They do not detect compromised mailboxes.
Where each lives in DNS
- SPF: TXT record at the domain root beginning v=spf1.
- DKIM: TXT record at <selector>._domainkey.<domain>.
- DMARC: TXT record at _dmarc.<domain>.
Checklist
- ☐ One SPF record
- ☐ DKIM enabled for each sender
- ☐ DMARC present and enforcing
- ☐ Lookalike domain monitoring in place
Methodology
Summarises the behaviour defined in RFC 7208, RFC 6376 and RFC 7489.