SPF, DKIM and DMARC are three DNS-based checks for email. Each answers a different question, and DMARC combines the answers of the other two.
SPF is a list of the servers allowed to send email for your domain. The receiving server compares the sending server with that list.
DKIM adds a cryptographic signature to each message. The receiver finds the matching public key in your DNS and checks that the message was signed by your domain and was not changed on the way.
DMARC checks whether SPF or DKIM passed and matches the visible From address. It also states your policy for failures and asks for reports.
SPF can break when mail is forwarded, and DKIM can break when a message is altered. Having both gives DMARC two chances to pass for genuine email.
DNS Domain Detective checks all three for your domain and shows the exact records to fix. Open DNS Domain Detective
DNS Domain Detective is now available on the App Store.
Last reviewed: 2026-11-02
#DNS #DKIM #SPF #DMARC #EmailSecurity #SysAdmin #MSP #iOS
This page gives general information and is not legal, financial or medical advice. [email protected]