SPF, DKIM, and DMARC Explained for Non-Technical Business Owners

Email was designed without any way to verify who sent a message. Anyone can put your domain in the From field, which is why phishing works. SPF, DKIM, and DMARC are the three standards that were bolted on afterwards to fix that, and since February 2024 Google and Yahoo have required all three from bulk senders. Here is what each actually does, in the order they were built.

SPF: which servers may send for your domain

SPF, the Sender Policy Framework, is specified in RFC 7208. You publish a TXT record in your DNS listing the mail servers authorized to send on behalf of your domain. A receiving server looks up that record and checks whether the machine actually connecting appears on the list.

Two limitations matter in practice. SPF checks the envelope sender, which is not the From address a human sees, so on its own it does not stop someone forging your visible From line. And SPF breaks on forwarding: when a message is relayed through a mailing list or a forwarding address, the connecting server is no longer one you listed. That is precisely the gap DKIM closes.

DKIM: proof the message was not altered

DKIM, DomainKeys Identified Mail, is specified in RFC 6376. Your sending system signs each outgoing message with a private key, adding a header containing the signature. You publish the matching public key in DNS. The receiving server retrieves the key, verifies the signature, and learns two things: the message genuinely came from a system holding your domain’s key, and the signed portions were not modified in transit.

Because the signature travels with the message rather than depending on the connecting IP, DKIM survives forwarding. This is why the two standards are complementary rather than alternatives.

DMARC: alignment, policy, and reporting

DMARC, Domain-based Message Authentication, Reporting and Conformance, was originally published as RFC 7489 in 2015 as an Informational document. In May 2026 it was revised and placed on the IETF standards track as RFC 9989, with aggregate and failure reporting split into RFC 9990 and RFC 9991. RFC 9989 obsoletes 7489.

DMARC adds three things on top of SPF and DKIM. Alignment: it requires that the domain which passed SPF or DKIM matches the domain in the visible From header, which is what turns two envelope-level checks into a statement about the address a human reads. Policy: you declare what receivers should do with mail that fails, using p=none, p=quarantine, or p=reject. Reporting: receivers send you aggregate XML reports about every source sending mail claiming to be your domain.

The reporting is the part people skip and should not

The enforcement policy gets all the attention, but the aggregate reports are what make DMARC useful before you enforce anything. Publish p=none with a reporting address and within a week you will have a list of every system sending mail as your domain: your email platform, your invoicing tool, the booking system somebody set up three years ago, and anyone impersonating you. Most businesses discover at least one legitimate sender they had forgotten, which is exactly the thing that would have broken had they gone straight to p=reject.

How to roll it out without breaking your own mail

1. Publish SPF and DKIM records for every system that sends as your domain, using the values each vendor provides. Note that SPF has a hard limit on DNS lookups, so consolidate rather than appending another include for every new tool.
2. Publish DMARC at p=none with an rua reporting address. Nothing changes for your mail; you start collecting data.
3. Read the reports for two to four weeks. Identify every legitimate sender and fix the ones failing alignment.
4. Move to p=quarantine, optionally with a percentage (pct) so only part of failing mail is affected at first.
5. Move to p=reject once reports are clean. This is the level that actually stops your domain being used in phishing.

Why bulk senders no longer have a choice

Since February 2024, Google and Yahoo have required bulk senders to have SPF and DKIM in place, to publish a DMARC record (p=none is sufficient for the minimum), and to align the From header with either the SPF or the DKIM domain. They also require one-click unsubscribe per RFC 8058, and a spam complaint rate below 0.3%. Authentication is now the price of entry rather than an optimization, and unlike the complaint rate it is a one-time piece of work.

Valter Brandt

Chief Marketing Officer

Valter Brandt is the Chief Marketing Officer of ThisCom, working with clients across the United States and Europe. He has led marketing strategy through the major shifts in social advertising, mobile, content marketing, programmatic media, and marketing automation.

All articles by Valter Brandt →