Business emails must reliably accomplish two things: they must reach the recipient, and the recipient should be able to verify whether a message actually originates from the specified domain.
Three technical processes play a central role precisely in this regard: SPF, DKIM, and DMARC.
The terms seem complicated at first. However, the basic principle behind them is comparatively simple: SPF specifies which servers are allowed to send emails for a domain, DKIM provides messages with a verifiable digital signature, and DMARC defines how to handle messages that fail these checks.
This article explains SPF, DKIM, and DMARC in an understandable way, shows why the three methods belong together, and why correct configuration is part of the basic email infrastructure for companies today.
Why does an email even need to be authenticated?
An email sender address is generally easier to spoof than many users assume.
For example, attackers can try to make a message look as if it came from rechnung@ihre-firma.ch, even though the email was actually sent via a third-party system.
This spoofing of a third-party sender identity is frequently referred to as Email spoofing is referred to. It plays an important role in phishing and fraud attempts, among other things.
SPF, DKIM, and DMARC help receiving mail servers technically better evaluate such messages.
What is SPF?
SPF stands for Sender Policy Framework.
An entry in the DNS of a domain determines which mail servers or systems are authorized to send emails on behalf of that domain.
Put simply, SPF answers the question:
„Is this server even allowed to send emails for this domain?“
A simple example
Assuming a company sends its emails exclusively via a specific mail server.
The SPF record can specify that this server is authorized to send emails. If a foreign mail server subsequently receives a message, it can check the SPF rule of the sender domain.
If the message comes from an authorized system, it passes this check.
If it is sent via an unintended server, however, this can be taken into account when evaluating the message.
Why SPF alone is not enough
SPF is important, but it does not solve the email authentication problem on its own.
Among other things, forwards and more complex shipping structures can affect the SPF check. Furthermore, SPF does not simply authenticate the visible sender the way a user perceives it in their email program.
That is why SPF is combined with other methods in a clean email configuration.
What is DKIM?
DKIM stands for DomainKeys Identified Mail.
While SPF verifies the sending server, DKIM uses a cryptographic signature.
The sending mail server applies a digital signature to an email. The corresponding public key is provided via the domain's DNS.
This allows the receiving mail server to verify whether the DKIM signature is valid.
Simply answered, DKIM answers the question:
„Is this message provided with a valid signature from the domain in question?“
Why DKIM matters for deliverability
Email providers must distinguish enormous amounts of legitimate, unwanted, and fraudulent messages daily.
A correctly configured DKIM signature provides an additional technical trust signal.
While DKIM alone does not guarantee that a message will land in the inbox, together with a clean sending configuration, SPF, DMARC, and a good sender reputation, it contributes to a professional email infrastructure.
What is DMARC?
DMARC stands for Domain-based Message Authentication, Reporting and Conformance.
DMARC builds upon SPF and DKIM and complements them with rules and reporting capabilities.
Using a DMARC record, the domain owner can specify how receiving systems should handle messages that fail the intended authentication checks and the required alignment with the sender domain.
Thus, DMARC simplifies the answer to the question:
„What is supposed to happen if a message fails the required checks?“
The three possible DMARC policies
DMARC essentially knows three policies:
- p=none – monitor, without requesting message treatment based on the DMARC policy
- p=quarantine – failed messages, for example, should be treated as suspicious
- p=reject – Messages that fail the DMARC check should be rejected.
Especially with DMARC, it is important not to simply activate the strictest setting without checking.
A company may send mail not only via its regular mail server, but additionally via:
- Newsletter systems
- CRM software
- Online stores
- Contact forms
- Support systems
- external cloud services
If these legitimate shipping sources are not taken into account, your own emails may encounter authentication issues.
SPF, DKIM, and DMARC Working Together
The three methods fulfill different tasks and should therefore not be considered as alternatives.
- SPF Which systems are allowed to send emails for the domain?
- DKIM: Is the message provided with a verifiable digital signature?
- DMARC: Do authentication and sender domain match according to DMARC rules, and how should errors be handled?
Only the interplay creates a significantly better basis for distinguishing legitimate news from emails sent abusively in the name of a domain.
What does DMARC alignment mean?
An important component of DMARC is the so-called Alignment.
This involves a simplified check to see whether the domains used for SPF or DKIM match the domain that the recipient sees as the sender.
This is important because a message can technically pass an SPF or DKIM check without that authentication actually belonging to the visible sender domain.
DMARC therefore connects the technical checks with the domain that appears as the sender to the recipient.
DMARC Reports: see who is sending on behalf of your domain
A particularly interesting component of DMARC is the reporting capabilities.
Domain owners can receive so-called aggregated DMARC reports. These provide information on which systems are sending emails using the domain and how SPF and DKIM checks perform in the process.
This can help:
- discovering forgotten legitimate shipping services
- Detecting misconfigurations
- to make unknown shipping sources visible
- to prepare a stricter DMARC policy in a controlled manner
DMARC should therefore ideally not just be set up and subsequently forgotten.
Do SPF, DKIM, and DMARC improve email deliverability?
Proper authentication is an important component of professional email deliverability. However, it is not a guarantee that every message will land in the inbox.
Email providers consider numerous other factors, for example:
- Sender server reputation
- Domain reputation
- Shipping behavior and volume
- Content of the message
- Reactions of the recipients
SPF, DKIM, and DMARC thus create an important technical foundation, but they do not replace an overall clean email infrastructure.
We explain more about this in the article Email security and deliverability for SMEs .
Do SPF, DKIM, and DMARC protect against spam and phishing?
An important distinction is necessary here.
SPF, DKIM, and DMARC help in particular to make the abuse of a domain as a forged sender identity more difficult and to provide receiving systems with additional information for evaluating a message.
However, they do not prevent every form of phishing.
An attacker can, for example, register their own similar-looking domain and send technically correctly authenticated emails from it.
Therefore, additional protection mechanisms are necessary. A professional spam filter analyzes incoming messages based on additional criteria.
We explain how this additional layer of protection works in the guide SpamExperts: How professional spam and phishing protection works .
The domain is the foundation of email security
SPF, DKIM, and DMARC are configured via DNS records of your own domain.
This once again shows how closely domains and email are technically linked.
Faulty DNS settings can not only affect a website, but also have a direct impact on email communication.
You can find the basics in the article Domain & E-Mail – Why Both Are Inseparably Connected .
Common mistakes with SPF, DKIM, and DMARC
In practice, similar configuration errors occur again and again.
- several independent SPF records
- forgotten external shipping services
- Unneeded systems remain included in the SPF record
- DKIM was activated at the provider, but was not correctly set up in the DNS
- DMARC is set to a strict policy too quickly
- DMARC reports are being set up, but not evaluated
- Changes to mail servers are made without adjusting the DNS records
Especially for companies that use multiple systems for sending emails, an inventory assessment before making changes is advisable.
Why centralized administration makes things easier
Problems often arise when the domain, DNS, hosting, and email are managed by different service providers.
In the event of an error, the search for responsibility quickly begins: Is the mail server the problem? The DNS provider? The domain? The newsletter system? Or the website?
A coordinated administration reduces these interfaces and facilitates both setup and subsequent troubleshooting.
Information regarding CURIAWEB's email solutions can be found at: Email Services & Email Security .
Conclusion: SPF, DKIM and DMARC belong together
SPF, DKIM, and DMARC may look like three complicated technical abbreviations at first glance. However, the basic principle is easy to understand.
SPF defines permitted shipping sources, DKIM adds a verifiable signature to emails and DMARC connects these methods with the visible sender domain and defines the handling of errors.
Together, they form an important foundation for modern business email communication. They make the misuse of one's own domain more difficult, support the technical trustworthiness of legitimate messages, and provide additional control options with DMARC.
However, they do not replace a professional spam filter, secure access credentials, or a cautious approach to suspicious messages.
Email security works best when domain, DNS, authentication, spam filtering, and user accounts are viewed as an interconnected system.
