SPF, DKIM, and DMARC: A Practical Email Deliverability Baseline

Email authentication helps receiving systems assess whether a message is authorized and whether its content aligns with the sender's domain. SPF, DKIM, and DMARC serve related but different purposes.

SPF identifies which sending hosts are authorized for a domain. A domain should publish one SPF policy record rather than several competing SPF records. DKIM adds a cryptographic signature to outgoing messages; the public key is published in DNS while the sending system keeps the private key protected.

DMARC tells receivers how to evaluate alignment between the visible From domain and SPF or DKIM authentication, and where aggregate reports can be sent. Start with a monitoring policy, review reports, identify legitimate sending services, and only tighten enforcement after those services are correctly configured. A policy that is too strict too early can disrupt legitimate mail.

Check the actual message headers from each sending path, including website forms, newsletters, CRM tools, and transactional mail. DNS records alone do not prove that a service is signing or sending with the expected domain.