MAILTRUST / LEARN/SPF-DMARC-DKIM
A guide to email authentication
SPF, DKIM and DMARC each answer a different question.
SPF: who may send?
SPF publishes sender authorization for SMTP identities. It is evaluated against a specific sending IP and identity.
DKIM: was a message signed?
DKIM uses a domain’s published public key to verify a signature on an actual message. A selector identifies the key.
DMARC: does the identity align?
DMARC combines authentication and alignment with a domain’s requested handling policy. DNS alone cannot determine a message outcome.
Common mistakes
Publishing multiple SPF records, changing enforcement before reviewing reports, and assuming a published DKIM key proves signing are common sources of confusion.
Glossary
Selector: a name for a DKIM key. Alignment: the relationship between authenticated domains and the author domain. MX: a mail-routing DNS record.