SPF, DKIM, and DMARC

Three checks that prove you are allowed to send. They do not prove anyone wanted the message.

SPF, DKIM, and DMARC are the floor under a sending domain. Passing them means the receiver can trust that the mail came from you and was not altered on the way. Failing them is a reason to stop and fix DNS before you rewrite a word of copy.

Passing them is not a reason to send more. Inbox placement after that depends on whether people reply, complain, or recognise one template. This guide is only the three checks, and how they fit together.

What each one answers

SPF is a list of servers allowed to send for the domain. One record. If the includes chain past the ten DNS lookups SPF allows, the check fails even though the mail left your platform. DKIM is a signature. It proves the message still matches what you signed, and that you hold the key. DMARC is the policy. It tells the receiver what to do when SPF or DKIM does not align with the address in the From line.

Alignment is the part teams skip

Alignment means the domain people see and the domain you authenticate are the same organisation. You can have a valid DKIM signature on a different domain and still fail DMARC. Read the reports. A pass on a dashboard that ignores alignment is not a pass.

Start DMARC where you can see the reports before you jump to a reject policy you do not understand. The point of the policy is to stop other people sending as you, not to decorate the DNS page.

When to stop touching DNS

Check the four things once: one SPF record inside the lookup limit, a DKIM signature that validates, a DMARC policy you actually read, and alignment between the visible domain and the signed domain. If any fail, fix them and send nothing new until they pass.

If they pass and mail still lands in spam, more DNS records will not move it. Go back to replies, complaints, and whether every email shares one shape.