In short
In most cases you need all three. SPF authorises sending servers, DKIM signs the message, and DMARC ties both to the visible sender domain and sets a policy. Without DMARC, neither reliably protects against forged From addresses.
| Criterion | SPF / DKIM | DMARC |
|---|---|---|
| What is checked | SPF: may this IP send for the envelope domain? DKIM: is the signature valid? | Does at least one passing SPF or DKIM match the From domain (alignment)? |
| Applies to | SPF: MAIL FROM / Return-Path. DKIM: domain in the d= tag | The visible address in the From: header |
| DNS record | SPF: TXT on the domain. DKIM: TXT at selector._domainkey | TXT at _dmarc.<domain> |
| Forwarding | SPF usually breaks, DKIM survives as long as the message is unchanged | Passes if DKIM survives aligned |
| Mailing lists | DKIM often breaks because subject or footer get modified | Can fail when neither SPF nor DKIM stays aligned |
| Policy | No instruction to the receiver of its own (SPF -all is handled inconsistently) | p=none, quarantine or reject |
| Reports | None | Aggregate reports via rua= to an address you choose |
| Typical limit | SPF: at most 10 DNS lookups. DKIM: keys must be maintained and rotated | Only works once all legitimate senders pass SPF or DKIM aligned |
Pick SPF / DKIM if …
- you are starting out: without working SPF and DKIM, DMARC has nothing to build on.
- you connect newsletter or ticketing tools that send on your behalf. Each needs an SPF entry or its own DKIM key.
- mail gets forwarded. DKIM saves delivery here, SPF alone does not.
- your SPF record hits the lookup limit and you would rather secure senders via DKIM.
Pick DMARC if …
- you want to see who sends mail in your name. Start with
p=noneand reports. - your domain is abused for phishing and receivers should reject forged mail.
- large mailbox providers require it for bulk senders.
- all legitimate sources are known and you want to move step by step to
quarantineandreject.
Pitfalls from operations
- More than one SPF record on the same domain results in
permerror. Merge everything into one record. - Too many
include:entries exceed the 10 DNS lookup limit. Often noticed only when a provider extends its own record. - Long 2048-bit DKIM keys get entered wrongly in DNS, truncated or with broken quoting. Check with
dig TXT. - Starting directly with
p=rejectoften blocks forgotten senders such as invoicing systems or scanners. Read the reports first.
FAQ
Is SPF alone enough?
No. SPF only checks the envelope domain, not the address recipients see in their mail client. Only DMARC links the result to the From domain. SPF also breaks with forwarding.
Do I need DKIM if SPF already passes?
Yes. DKIM survives forwarding, SPF usually does not. For a stable DMARC result at least DKIM should pass aligned, ideally both.