SPF vs DKIM vs DMARC: what does each one do?

SPF authorizes sending servers, DKIM verifies a domain’s message signature, and DMARC connects a passing SPF or DKIM identity to the visible From domain. They perform different checks. For your marketing email, inspect the identities and results on an actual message: published DNS records or two passing checks do not, by themselves, establish DMARC alignment or inbox placement.

For a retention marketer, the useful handoff is more specific than “our domain is authenticated.” Record which system sent the message, which domains passed, and whether a passing domain aligns with the address customers see.

What is the difference between SPF, DKIM and DMARC?

SPF checks sending-server authorization for the envelope domain. DKIM verifies a signing domain’s message signature. Under an applicable DMARC record, DMARC requires a passing SPF or DKIM identity aligned with the visible From domain. None of these results guarantees inbox placement.

The visible From is the address displayed as the sender, such as offers@example.com. The envelope sender, also called SMTP MAIL FROM, is a separate identity used during delivery. The SPF standard authorizes hosts for that envelope identity; it does not authenticate the visible address simply because an SPF check passes.

DKIM associates a signing domain with a signature that the receiver verifies using its public key. In the DKIM-Signature header, d= identifies that domain and s= identifies the selector used to find the key. Verification concerns the signed content, so avoid reading “DKIM pass” as proof that every part of a message is unchanged.

DMARC adds the connection to the visible From domain. This connection is called alignment.

How can SPF and DKIM pass while DMARC fails?

They can pass for domains unrelated to the visible From domain. A valid signature from a sending provider is not automatically an aligned signature for your brand.

Consider this invented direct-email example, with a valid, applicable DMARC record for example.com:

If that message instead carries a valid passing DKIM signature with d=example.com, it has an exact aligned identity. DMARC can pass even though SPF still passes only for the unrelated relay domain. Changing the text of a signature header is not a fix; the sending system must produce a valid signature.

DMARC needs at least one aligned passing mechanism. Under strict alignment, domains must be identical; under relaxed alignment, they must share the same organizational domain. Have the sending owner verify the applicable mode and domain relationship rather than judging alignment from similar-looking names.

Do marketing senders need all three?

Check the receiving provider’s requirements separately from DMARC’s pass rule.

Google’s personal-Gmail guidelines require SPF or DKIM for all senders, and SPF and DKIM plus DMARC for bulk senders. Google recommends setting up all three for sending domains. For direct bulk mail, the visible From domain must align with either the SPF or DKIM domain; Google permits a DMARC policy of p=none.

Consequently, for bulk senders to personal Gmail accounts, “DMARC passes through DKIM” does not establish that you meet Google’s separate SPF requirement. Likewise, “we published DMARC” does not establish a passing result on your messages.

These are Google’s authentication requirements, not a complete checklist for every mailbox service. The deliverability guide covers provider scope and the wider sending requirements, including unsubscribe handling.

How do you check an actual marketing email?

Inspect a message delivered through the sending route you want to verify. In desktop Gmail, open it and choose More beside Reply → Show original. Google documents this full-header view.

Use the receiving provider’s own authentication results from the original message and preserve this audit record:

Then send your provider a question tied to the failed check:

• SPF does not pass: is the sending server authorized for the envelope domain actually used?
• DKIM is missing or fails: is this route signing, is the key configuration correct, or was signed content changed?
• SPF and DKIM pass but DMARC fails: which domains passed, do they align, and is the applicable DMARC record valid?
• All pass but mail arrives in spam: investigate the broader placement problem. Google explicitly says authentication alone cannot guarantee delivery.

Repeat the record for the routes you use. A newsletter result is evidence about that message, not about the authentication of an order receipt or support reply. Forwarded mail and mailing lists need their own route-specific investigation.

How should you approach setup and DMARC policy?

Inventory your sending routes, configure SPF and DKIM with the relevant providers, and inspect actual messages. Use DMARC aggregate reports to identify and correct legitimate failing streams before stronger enforcement. Assign an owner to each change:

1. List the systems sending campaigns, flows, transactional messages and support mail under your domain.
2. Ask each sending provider for its required envelope-domain, SPF and DKIM configuration. Give those requirements to the DNS owner rather than copying another sender’s records.
3. Reconcile SPF at the relevant domain. The SPF standard prohibits multiple records that would make the check select more than one SPF record; adding a second one is not the way to add another sender.
4. Inspect messages from the actual routes and resolve authentication or alignment failures.
5. Review DMARC aggregate reports to find legitimate sending streams the inventory missed before tightening enforcement.

DMARC offers p=none, p=quarantine and p=reject. The latter two express progressively stronger assessments of failing mail; the receiver retains discretion over handling. p=none does not turn a DMARC failure into a pass.

RFC 9989 advises beginning with p=none and aggregate reporting, then correcting legitimate unauthenticated or unaligned streams before enforcement. Arrange report parsing and review, not just a mailbox that collects reports. Choose a stronger policy against that evidence rather than an arbitrary waiting period.

If the unresolved question is whether to separate marketing and transactional routes, use the sending-subdomain guide. If a message was rejected, the hard-versus-soft-bounce guide covers retries and contact eligibility. Authentication configuration answers a different question from either decision.

Frequently asked questions

Can DMARC pass if SPF fails?

Yes, with an applicable DMARC record and a valid passing DKIM signature whose signing domain aligns with the visible From domain. That DMARC pass does not remove a mailbox provider’s separate SPF requirement, such as Google’s requirement for bulk senders to personal Gmail accounts.

Does p=none mean DMARC is disabled?

No. A valid applicable DMARC record with p=none still allows a pass or fail result. The policy expresses no handling preference for failing mail. It does not force a pass or guarantee delivery; aggregate reporting also needs to be configured if you want reports.

Does passing SPF, DKIM and DMARC guarantee inbox placement?

No. Authentication establishes the relevant domain checks, not guaranteed inbox placement. Google says authentication alone cannot guarantee delivery and combines it with other signals when classifying messages. Investigate the actual placement problem even when authentication passes.