SPF vs DKIM vs DMARC: what each one checks and why you need all three

SPF (RFC 7208) works on the envelope sender, the hidden return address you see as Return-Path in the headers. The receiver looks up the SPF record of that domain and checks whether the connecting server's IP address is on the list. It breaks when mail is forwarded, since the forwarding server isn't on your list.

DKIM (RFC 6376) signs the message. Your mail server adds a DKIM-Signature header made with a private key, and the receiver fetches the public key from DNS, using the selector and domain named in that header. The signature survives forwarding as long as nobody edits the signed headers or the body.

DMARC (RFC 9989) closes the gap both leave. It passes only when SPF or DKIM passes for a domain that matches the From address, which DMARC calls alignment. Its p= tag asks receivers to do nothing (none), send failures to spam (quarantine) or turn them away (reject). Its rua= tag asks for daily reports on who sends mail as you.

Gmail has required SPF or DKIM from every sender since February 2024. Senders who send more than 5,000 messages a day to Gmail accounts need all three, though their DMARC policy can stay at p=none.

The DNS Lookup reads all three. SPF and DMARC show up as soon as you look a domain up, and DKIM needs the selector from one of the domain's messages.