DMARC vs SPF vs DKIM: What's the Difference?
Vysiro Team · October 28, 2025 · Updated March 2026 · 8 min read
Quick Overview
SPF, DKIM, and DMARC are three email authentication protocols that work together to prevent email spoofing and phishing. Each one serves a different purpose, and you need all three for complete protection. Here is the shortest possible summary:
SPF
Specifies which IP addresses and servers are authorized to send email for your domain. Think of it as an allowlist for your mail servers.
DKIM
Adds a cryptographic signature to outgoing emails so receivers can verify the message was not altered in transit and was authorized by the signing domain.
DMARC
Tells receiving servers what to do when SPF or DKIM fails, requires domain alignment, and sends reports back to you about email activity on your domain.
How SPF Works
SPF (Sender Policy Framework) is a DNS-based protocol that lets you declare which mail servers are authorized to send email on behalf of your domain. When a receiving server gets an email, it checks the SPF record of the envelope sender's domain (the Return-Path) to see if the sending IP address is authorized.
An SPF record is published as a TXT record at your domain. Here is a typical example:
This record says: "Accept emails from Google Workspace servers, SendGrid servers, and the IP address 203.0.113.5. Reject everything else."
The 10-Lookup Limit
SPF has a critical limitation: the DNS lookup limit. Your SPF record can trigger a maximum of 10 DNS lookups (each include:, a:, and mx: mechanism counts as one lookup). If you exceed this limit, the entire SPF check fails with a permanent error. This is a common problem for organizations using many SaaS email services. Use Vysiro's SPF validator to check your lookup count.
Key limitation: SPF only validates the envelope sender (Return-Path), not the visible From header. This means an attacker can pass SPF using their own domain in the Return-Path while displaying your domain in the From address that users see. This is why SPF alone is not enough.
How DKIM Works
DKIM (DomainKeys Identified Mail) uses public-key cryptography to sign outgoing emails. When your mail server sends an email, it calculates a cryptographic hash of certain headers and the body, then signs that hash with a private key. The signature is added as a DKIM-Signature header in the email.
When the receiving server gets the email, it looks up the public key in DNS (published as a TXT record at selector._domainkey.yourdomain.com) and uses it to verify the signature. If the signature is valid, the receiver knows two things: the email was authorized by the signing domain, and the email was not altered during transit.
A DKIM signature header looks like this:
The key tags are: d= (the signing domain), s= (the selector, used to find the public key in DNS), and h= (the headers included in the signature).
Key limitation: DKIM proves the email was signed by a specific domain, but it does not tell the receiving server what to do if the signature fails or is missing. It also does not require the signing domain to match the From domain. An attacker can DKIM-sign an email with their own domain while spoofing your domain in the From header. This is the gap that DMARC fills.
How DMARC Works
DMARC builds on SPF and DKIM by adding two critical features: alignment and policy.
Alignment means the domain used in SPF or DKIM must match the domain in the visible From header. SPF alignment requires the Return-Path domain to match the From domain. DKIM alignment requires the d= domain in the DKIM signature to match the From domain. At least one must align for the email to pass DMARC.
Policy tells receiving servers what to do when alignment fails: deliver normally (none), send to spam (quarantine), or block entirely (reject). This is something neither SPF nor DKIM can do on their own.
DMARC also introduces reporting. Receiving servers send aggregate reports (XML) back to the domain owner, providing visibility into who is sending email using the domain and whether those messages are passing authentication. This is invaluable for discovering unauthorized senders and fixing misconfigured legitimate ones. Learn more in our complete DMARC guide.
Side-by-Side Comparison
| Feature | SPF | DKIM | DMARC |
|---|---|---|---|
| Purpose | Authorize sending IPs | Verify message integrity | Enforce policy & reporting |
| DNS Record Type | TXT at domain root | TXT at selector._domainkey | TXT at _dmarc |
| What It Checks | Sender IP vs authorized list | Cryptographic signature on email | SPF/DKIM alignment with From header |
| Authentication Method | IP allowlist | Public-key cryptography | Alignment verification |
| Prevents Spoofing Alone? | No (Return-Path only) | No (no policy enforcement) | Yes (with SPF or DKIM) |
| Provides Reports? | No | No | Yes (aggregate + forensic) |
| Required by Gmail/Yahoo? | Yes | Yes | Yes (for bulk senders) |
How They Work Together
Think of SPF, DKIM, and DMARC as three layers of a defense system. Each one covers a gap the others cannot:
SPF verifies the sending server is authorized. It answers: "Is this server allowed to send email for this domain?"
DKIM verifies the message was not tampered with. It answers: "Was this email modified after it was sent?"
DMARC enforces the rules and reports results. It answers: "Does the authenticated domain match the From domain, and what should we do if it doesn't?"
Without DMARC, SPF and DKIM are like security cameras with no one watching the monitors. They record activity but do not enforce any rules. DMARC is the security guard that watches the cameras and takes action when something is wrong.
For the best protection, configure all three and set your DMARC policy to p=reject once you have confirmed all legitimate email sources are aligned. Use Vysiro's free scanner to check all three records in one scan.
Common Misconceptions
Myth: "SPF is enough to prevent spoofing"
Reality:SPF only checks the Return-Path domain, not the visible From address. An attacker can use their own Return-Path (passing SPF) while displaying your domain in the From header. Without DMARC's alignment check, SPF alone does not prevent spoofing of the visible sender.
Myth: "DKIM encrypts my emails"
Reality: DKIM signs your emails with a cryptographic signature to prove authenticity and integrity. It does not encrypt the content. Anyone who intercepts the email can still read it. Encryption requires TLS (in transit) or S/MIME/PGP (end-to-end).
Myth: "I have DMARC set to none, so I'm protected"
Reality: A DMARC policy of p=none only monitors; it does not block anything. Spoofed emails are still delivered normally. The p=none policy is a starting point for collecting reports, not a protection mechanism. You need to move to quarantine or reject for actual enforcement.
Myth: "These protocols stop all phishing"
Reality: SPF, DKIM, and DMARC prevent direct domain spoofing (someone sending from your exact domain). They do not prevent look-alike domain attacks (e.g., vysir0.com vs vysiro.com), display-name spoofing, or compromised account attacks. They are one essential layer, not a complete solution.
Frequently Asked Questions
Do I need all three: DMARC, SPF, and DKIM?+
Which should I set up first: SPF, DKIM, or DMARC?+
Can SPF alone prevent email spoofing?+
What is the SPF 10-lookup limit?+
Does DKIM encrypt my emails?+
Secure Your Domain Today
Scan your domain for free. Get a TrustScore across 30 security categories in under 60 seconds.