SPF vs DKIM vs DMARC

SPF, DKIM, and DMARC work together, but they do different jobs. SPF checks whether a sending server is allowed to send mail for a domain. DKIM checks whether the message was cryptographically signed and not altered in transit. DMARC tells receivers how to handle messages that fail alignment checks and where to send reports.

SPF

SPF is a sender authorization policy published in DNS TXT records. It is useful, but by itself it is not a complete anti-spoofing control.

DKIM

DKIM adds a digital signature to an email. That lets the receiver validate that specific headers and content were signed with a key associated with the sending domain.

DMARC

DMARC builds on SPF and DKIM by adding alignment rules and policy instructions such as none, quarantine, or reject.

Practical takeaway

If you want a stronger email authentication posture, publish all three correctly and test them together instead of relying on only one control.