Authenticate the sender identity readers actually see.
Learn what SPF, DKIM, and DMARC authenticate, how alignment works, and how to stage policy without breaking legitimate email.
Email authentication establishes domain-level evidence. SPF evaluates an authorized envelope path, DKIM verifies a signature over selected message content, and DMARC asks whether a passing SPF or DKIM domain aligns with the visible From domain. The methods reduce spoofing risk, but they do not certify that a message is benign or wanted.
Three mechanisms, three jobs
SPF
Publishes which systems may send for an envelope domain. Forwarding can change the observed IP and break the path.
DKIM
Uses a domain signature to show that selected headers and body content verify with a DNS-published key.
DMARC
Connects passing authentication to the visible From domain through alignment, policy, and aggregate reporting.
Alignment is the bridge
A vendor can pass SPF for its own bounce domain or DKIM for its own signing domain without authenticating the customer’s visible From identity. DMARC requires at least one passing method whose authenticated domain aligns with the visible From domain. Relaxed alignment permits an organizational-domain relationship; strict alignment requires an exact match.
Using both aligned SPF and aligned DKIM creates resilience. Forwarding may break SPF, while message modification may break DKIM. Either aligned passing method can satisfy DMARC.
A staged deployment
- Inventory. Find every legitimate mail stream, owner, platform, visible From domain, envelope domain, DKIM domain, and business purpose.
- Authorize and sign. Build a single valid SPF policy per domain and enable DKIM with customer-controlled aligned domains where possible.
- Test delivered mail. Inspect authentication results after messages pass through the real production and forwarding paths.
- Monitor DMARC. Publish reporting, protect the reports, and classify sources before requesting enforcement.
- Advance policy gradually. Use controlled percentages or subdomains, watch operational outcomes, and preserve rollback.
- Maintain. Review new vendors, rotate DKIM keys, remove old SPF includes, and monitor alignment continuously.
Common failure patterns
| Pattern | Why it happens | Safer response |
|---|---|---|
| SPF passes, DMARC fails | The envelope domain does not align with visible From | Configure a custom aligned return path or aligned DKIM |
| DKIM passes, DMARC fails | The signing domain belongs to the vendor and is unaligned | Delegate a customer-controlled signing domain |
| DKIM fails after transit | A gateway or list changed signed content | Test the path and adjust signing or intermediary behavior |
| SPF permerror | Multiple records, syntax issue, or lookup limit | Consolidate and simplify the policy |
| Legitimate mail fails at enforcement | A sender was missing from inventory | Investigate and authorize only verified legitimate paths |
Authentication and mailbox verification solve different sides
Authentication evaluates the sender’s domain evidence. Mailbox validation evaluates destination evidence. A real mailbox does not make a spoofed sender legitimate, and a perfectly authenticated sender does not make the destination reachable or the message welcome.
Operational checklist
- Assign a named owner to every sending platform and domain.
- Keep SPF within protocol limits and remove abandoned sources.
- Use strong DKIM keys, controlled selectors, and scheduled rotation.
- Monitor DMARC reports and protect them as operational data.
- Separate mail streams by understandable subdomains where useful.
- Test visible From, return path, signature, links, and replies together.
- Review authentication whenever infrastructure or vendors change.
Go deeper
Read SPF, DKIM, and DMARC Alignment for Better Email Trust for detailed rollout guidance and common operational mistakes.