SPF, DKIM and DMARC: what each email-authentication layer does
Email authentication concerns the sender’s identity and message handling. It is not the same as verifying a recipient address. A domain can receive mail correctly while its outgoing messages have authentication problems, so inspect the correct side of the conversation.
Open the relevant free tool →Three records, three jobs
SPF describes authorised sending paths
SPF publishes rules for checking a sending IP against the domain used by the relevant envelope identity. A TXT lookup can show the policy, but finding a record is not the same as evaluating an actual message’s sender against it. Keep those two tasks distinct when describing a checker’s result.
DKIM adds a domain signature
DKIM lets a receiving system verify a message signature using public verification data associated with a signing domain and selector. A selector lookup can find a DNS record. It cannot prove that an unrelated message has a valid signature. To investigate a real message, retain its headers and the receiving system’s authentication results.
DMARC connects authentication to the visible sender
DMARC evaluates alignment with the domain in the visible From identity and publishes policy and reporting preferences. A passing SPF or DKIM result under a different, unaligned domain is not by itself the same as a DMARC pass. This is a common source of confusion during provider migrations.
Use a real-message workflow
Start with a message you are authorised to inspect. Identify the visible From domain, envelope-related domain, signing domain and selector. Compare the receiving system’s reported results with the published records. Avoid assuming that a public TXT record proves every message from the domain is authenticated correctly. Also distinguish a missing record from a DNS lookup that failed temporarily.
Update configuration deliberately
Inventory the services that send for your domain before changing policies. Use each provider’s exact setup instructions and test with controlled messages. Do not copy another organization’s records or enforce a policy without checking legitimate senders. Keep a record of changes and inspect reports where available. If a bounce points to authentication, address the sending configuration instead of deleting a technically valid recipient.