SPF, DKIM and DMARC explained
Understand what SPF, DKIM and DMARC check, how identifier alignment works, and what the none, quarantine and reject DMARC policies mean.
SPF authorizes the sending server
SPF checks whether the sending IP is allowed to send for the envelope sender domain, usually shown in Return-Path. For DMARC, that domain also needs to align with the visible From domain. SPF can pass while DMARC still fails if the identities do not align.
DKIM signs the message
DKIM adds a cryptographic signature to the message. A receiving server verifies it using the public key published in DNS. DMARC can use a passing DKIM signature when its signing domain aligns with the visible From domain. DKIM can survive forwarding when the signed message content is preserved.
DMARC ties authentication to the From domain
DMARC passes when at least one of SPF or DKIM passes and aligns with the visible From domain. Relaxed alignment allows related subdomains of the same organizational domain; strict alignment requires an exact domain match.
Understand the DMARC policy
A policy of none requests monitoring without enforcement. Quarantine asks receivers to treat failing messages as suspicious, and reject asks them to reject failing messages. Receivers apply their own local policies, so authentication alone does not guarantee delivery or inbox placement.