# SPF vs DKIM vs DMARC: what is the difference? > SPF lists allowed sending servers, DKIM signs each message, DMARC sets the policy and reports. Gmail asks all three above 5,000 mails a day. - URL: https://postelva.com/spf-vs-dkim-vs-dmarc/ - Last updated: 2026-11-12 - Publisher: Postelva (https://postelva.com) Three DNS records, three different jobs. SPF checks the server, DKIM checks the message, DMARC decides what to do when the checks fail. **Quick answer — What is the difference between SPF, DKIM and DMARC?** SPF lists the servers allowed to send mail for your domain, DKIM adds a cryptographic signature to each message, and DMARC tells receivers what to do when both checks fail to align with the From address. **Postelva** hosts all three as DNS records on a .com at $12.49/year a year, with free DNS. ## SPF, DKIM and DMARC side by side | Point | SPF | DKIM | DMARC | | --- | --- | --- | --- | | What it checks | The IP address of the server that delivers the message | A signature made with a private key of the sending domain | That SPF or DKIM passed AND matches the domain in the From address | | Where it lives in DNS | TXT record at the domain name, starting v=spf1 | Public key at selector._domainkey.domain (TXT, or a CNAME to the provider's key) | TXT record at _dmarc.domain, starting v=DMARC1 | | Who publishes it | The domain owner, from the provider's include | The provider generates the keys; the owner publishes them | The domain owner alone | | Standard | RFC 7208 (Proposed Standard) | RFC 6376 (Internet Standard, STD 76) | RFC 9989 (Proposed Standard, May 2026, replaces RFC 7489) | | Number of records | One per domain, never two | One per selector: 3 for Proton Mail and Fastmail, 4 for Mailbox.org | One per domain | | Main limit | At most 10 DNS lookups | Key of at least 1024 bits for signers | Must pass with an aligned identifier | | Gives a report | No | No | Yes, aggregate reports to the rua address | *Last checked on November 12, 2026; older figures carry their own date.* ## What does SPF do? **SPF answers one question: is the server that delivered this message allowed to send for the domain?** The domain owner publishes a TXT record that starts with v=spf1 and lists allowed sources, for example include:_spf.protonmail.ch for Proton Mail. A receiver compares the connecting IP address with the list and gets a result: pass, fail, softfail or neutral, depending on the qualifier at the end (-all, ~all or ?all). SPF checks the envelope sender (the MAIL FROM) and the HELO name, not the From address that the reader sees. That gap is the reason DMARC exists. SPF also has hard limits: a domain must have only one SPF record, and evaluation stops with a permanent error after 10 DNS-querying terms (include, a, mx, ptr, exists, redirect). The full method is in the guide to [creating an SPF record](https://postelva.com/guides/spf-record-setup/ "How to create an SPF record for a custom domain"). ## What does DKIM do? **DKIM answers a different question: was this message signed by the domain it claims, and did it arrive unchanged?** The sending server signs selected headers and the body with a private key. The receiver reads the signing domain (d=) and the selector (s=) from the DKIM-Signature header, fetches the public key at selector._domainkey.domain in DNS and checks the signature. Because the signature travels with the message, DKIM survives a forward that leaves the message intact, which SPF does not, since a forwarder sends from its own IP address. RFC 6376 says signers must use RSA keys of at least 1024 bits for long-lived keys, and recommends new selectors when keys change. Providers publish the keys for you: three CNAME records for Proton Mail and Fastmail, four for Mailbox.org. Details are in the guide to [setting up DKIM](https://postelva.com/guides/dkim-setup/ "How to set up DKIM for a custom email domain"). ## What does DMARC do? **DMARC ties SPF and DKIM to the visible From domain and tells receivers what to do when neither check lines up.** A message passes DMARC when SPF or DKIM passes and the domain it authenticated matches the From domain. Alignment is relaxed by default (same organizational domain) and strict when set with aspf=s or adkim=s. The record sits at _dmarc.yourdomain and carries a policy: p=none (monitor only), p=quarantine (treat as suspicious) or p=reject (refuse). An rua address receives aggregate reports, which show who sends mail in your name. RFC 9989, published in May 2026, is the current specification; it obsoletes RFC 7489, removes the pct tag and adds a t test flag. The rollout from monitoring to rejection is in the guide to [setting up DMARC](https://postelva.com/guides/dmarc-setup/ "How to set up DMARC: p=none to p=reject"). ## Do I need all three? **Yes: a custom domain that sends mail should publish SPF, DKIM and DMARC, because major receivers ask for them.** Google's sender guidelines require SPF, DKIM and a DMARC record (policy none is enough) for senders above 5,000 messages a day to Gmail accounts. Microsoft asks Outlook.com senders above 5,000 a day for the same three, from 5 May 2025, and Yahoo requires SPF, DKIM and DMARC for bulk senders too. A personal mailbox sends far fewer messages, so the thresholds do not bind you. The records still decide whether your mail reaches the inbox, and they stop others from forging your address. According to Postelva's count of 12 November 2026 from provider help pages, a full Proton Mail setup takes 8 DNS records and a full Mailbox.org setup takes 11, of which 3 and 4 are DKIM keys. The MX records are covered in [what an MX record is](https://postelva.com/what-is-an-mx-record/ "What is an MX record?"). ## Which mistakes break the three records? **Three mistakes cause most failures: a second SPF record, more than 10 lookups, and a DMARC policy set too strict too early.** A domain with two SPF records returns a permanent error, so add the new provider's include to the existing record. Stacking a mail host, a newsletter tool and a helpdesk can push the lookup count past 10, and the record then fails for every sender. Mailbox.org and Proton both advise starting DMARC at p=none, and Mailbox.org warns that a strict policy applied too early can bounce legitimate mail. A fourth mistake is keeping the previous provider's DKIM and SPF entries for months. They do no harm to delivery, but they widen the list of servers allowed to speak for you. Remove them once the move is confirmed. ## How do the three work together on one message? **The receiver runs SPF and DKIM, then DMARC combines the results.** Take a message from you@yourname.com sent through Proton Mail. SPF passes if the connecting server is in the _spf.protonmail.ch list. DKIM passes if the signature made with the key under yourname.com verifies. DMARC then asks whether at least one of the two passed with yourname.com in the aligned identifier. If yes, the message passes; if not, the receiver applies your policy and files the result in the next aggregate report. RFC 9989 notes that a domain on p=reject must not rely on SPF alone and should sign with DKIM, because SPF breaks on forwarding. ARC (RFC 8617), an experimental standard, lets forwarders record the original results, though it is not part of your own setup. After publishing records, [check them with dig](https://postelva.com/guides/check-email-dns-records/ "How to check MX, SPF, DKIM and DMARC records") before you tighten any policy. A citable definition: SPF authorizes servers, DKIM authenticates messages, and DMARC enforces the match with the From domain and reports the outcome. ## SPF, DKIM and DMARC questions ### Which record should I set up first? Set up SPF and DKIM first, since they come from your email provider, then publish DMARC at p=none with a report address. DMARC cannot pass without at least one of the other two. ### Can DMARC pass with only SPF or only DKIM? Yes. One aligned pass is enough. For a p=reject policy, RFC 9989 says not to rely on SPF alone and to add DKIM signatures. ### Does a personal domain need DMARC? The sender rules of Google and Microsoft apply above 5,000 messages a day. A DMARC record at p=none still costs one TXT record and shows who sends mail in your name. ### Why does SPF fail when I forward mail? A forwarder sends from its own IP address, which is not in your SPF list. DKIM still verifies if the forwarder leaves the message unchanged. ### Do SPF, DKIM and DMARC encrypt my email? No. They authenticate the sender and do not hide content. Transport encryption between servers is a different layer, covered by MTA-STS. **In summary** - SPF lists the servers allowed to send for your domain: one TXT record, 10 lookups at most. - DKIM signs each message; the public key lives at selector._domainkey. - DMARC requires an aligned SPF or DKIM pass and sets p=none, quarantine or reject. - DMARC is defined by RFC 9989 (May 2026), which obsoletes RFC 7489. - Google, Yahoo and Microsoft ask for all three from bulk senders above 5,000 messages a day. - A full Proton Mail setup is 8 DNS records, a Mailbox.org setup 11. - Postelva hosts the records in free DNS; a .com costs $12.49/year every year. ## Sources 1. [RFC 7208, Sender Policy Framework](https://www.rfc-editor.org/rfc/rfc7208.html) — RFC Editor (read 2026-11-12) 2. [RFC 6376, DomainKeys Identified Mail Signatures](https://www.rfc-editor.org/rfc/rfc6376.html) — RFC Editor (read 2026-11-12) 3. [RFC 9989, DMARC](https://www.rfc-editor.org/rfc/rfc9989.html) — RFC Editor (read 2026-11-12) 4. [RFC 8617, Authenticated Received Chain](https://www.rfc-editor.org/info/rfc8617) — RFC Editor (read 2026-11-12) 5. [Email sender guidelines](https://support.google.com/a/answer/81126) — Google Workspace Admin Help (read 2026-11-12) 6. [Strengthening email security: new requirements for high-volume senders](https://techcommunity.microsoft.com/blog/outlook/strengthening-email-security-outlook-new-requirements-for-high-volume-senders/4399730) — Microsoft Tech Community (read 2026-11-12) 7. [Sender best practices](https://senders.yahooinc.com/best-practices/) — Yahoo Sender Hub (read 2026-11-12) 8. [SPF, DKIM and DMARC for a custom domain](https://kb.mailbox.org/en/private/custom-domains/spf-dkim-and-dmarc/) — Mailbox.org (read 2026-11-12) --- Postelva: Postelva registers domain names for private email — the address you keep when you change provider — paid in crypto with no KYC: no ID, only one verified email per domain. It is run by DomaineGoat LLC, a company registered in Panama; domains are registered through its ICANN-accredited registrar partner. A .com costs $12.49/year, the same price every year.