SPF, DKIM and DMARC make the use of your sender domain easier to verify. They serve different purposes. Together, they help receiving systems distinguish authorised sending routes from misuse of a domain.
SPF: is the sending source authorised?
An SPF record identifies the sending sources authorised for a domain. The check primarily uses the domain of the technical envelope sender, or MAIL FROM. This can differ from the sender address visible in the email application. A successful SPF check alone therefore does not confirm the visible From domain.
DKIM: can the signature be verified?
DKIM links a message to a signing domain through a cryptographic signature. The recipient checks the public key in DNS and the signed parts of the message. This verifies neither the person using the sender account nor the accuracy of the content. Multiple sending platforms can use different keys.
DMARC: does the check match the visible domain?
DMARC relates authentication to the domain in the visible From field. At least one method must succeed with the required domain relationship: SPF or DKIM. This match is called alignment. Configuring both methods correctly remains sensible, even though one is enough for a DMARC pass.
A published policy describes the requested handling when the required authentication is missing. Receiving systems also apply their own assessment. A DMARC pass is therefore not a general seal of approval for a message.
Start with the actual sending routes
Microsoft 365 or Google Workspace are often only part of the picture. Newsletters, website forms, ticketing systems, ERP, scanners and monitoring can also send messages. These sources are inventoried first and discussed with the people responsible.
SPF and DKIM are then configured appropriately, reports are analysed and a suitable DMARC policy is tested step by step. Forwarding and mailing lists deserve particular attention. This helps identify effects on legitimate mail before rules are tightened.
Keep changes traceable
New platforms, service providers and domains belong in the same maintenance process. DAXS assists with inventory, DNS configuration, analysis and a coordinated introduction. Scope and ongoing support are agreed to fit your environment.
Explore communication and email services · Ongoing IT support · Discuss email protection
Technical references: SPF – RFC7208, DKIM – RFC6376 and DMARC – RFC9989.
