SPF, DKIM and DMARC: what’s the difference?

SPF, DKIM and DMARC are often mixed up. They’re not alternatives but complementary layers. Here’s the difference in short.

SPF — who may send

Sender Policy Framework is a list in your DNS of the mail servers allowed to send for your domain. The recipient checks whether the sending server is on the list.

DKIM — is the mail genuine

DomainKeys Identified Mail places a cryptographic signature in the header, verified via a public key in your DNS — proof the mail wasn’t altered in transit.

DMARC — what to do on failure

DMARC ties SPF and DKIM together and adds policy: what should a recipient do if neither aligns with your visible sender? And reporting: who sends in your name? Without DMARC, SPF and DKIM stay directionless.