Email Security: SPF, DKIM, and DMARC
On this page
Email was built without authentication, so anyone can put your domain in the From address — which is why phishing that impersonates trusted brands is so easy. Three DNS-based standards fix this: SPF, DKIM, and DMARC. Deployed together, they let receiving servers verify that mail claiming to be from your domain really is — and reject the rest.
What does each one do?#
| Standard | Role |
|---|---|
| SPF | Lists which servers may send mail for your domain |
| DKIM | Cryptographically signs messages to prove origin and integrity |
| DMARC | Ties SPF/DKIM to the visible From, sets policy, and reports |
SPF answers “is this sending server authorized?” DKIM adds a digital signature proving the message is genuinely from your domain and unaltered. DMARC is the enforcement layer: it requires SPF or DKIM to pass and align with the From address a human sees, then tells receivers what to do with failures — and sends you reports so you can see who is spoofing you.
How do they work together?#
The three are a stack: SPF and DKIM each provide a check, and DMARC decides what those checks mean
for your domain and enforces it. Rolling out DMARC starts at p=none (monitor only, read the
reports), then progresses to quarantine and finally reject once you are confident legitimate mail
passes.
Email authentication cuts impersonation-based phishing at the source. More at the Defense & Hardening hub.
Frequently asked questions#
What do SPF, DKIM, and DMARC do?
SPF specifies which servers may send email for your domain. DKIM cryptographically signs messages so recipients can verify they were not altered and came from your domain. DMARC ties the two together, tells receivers what to do with mail that fails, and sends you reports. Together they stop attackers from spoofing your domain in email.
Why does DMARC need SPF and DKIM?
DMARC builds on both: it checks that a message passes SPF or DKIM and that the domain aligns with the visible From address, then applies your policy (none, quarantine, or reject) to failures. Without SPF and DKIM there is nothing for DMARC to evaluate, and without DMARC their results are not enforced or reported.