SPF, DKIM and DMARC: How the Three Actually Fit Together

It is easy to assume these three exist as alternatives to each other, but they actually answer three different questions. SPF answers which servers are allowed to send for this domain. DKIM answers has this specific message been altered since it was signed. DMARC answers what should happen when a message fails either of those checks, and does the visible sender address actually match. A domain needs all three working together to get meaningful protection, since each one covers a gap the others leave open.

SPF is a published list, checked against the server a message actually came from. It is straightforward to check and straightforward to spoof around, since it says nothing about the message content or the visible sender address, only about which servers were allowed to send.

DKIM works differently. The sending server attaches a digital signature to each outgoing message, generated using a private key, and publishes the matching public key as a DNS record under a specific selector name chosen by the mail provider. A receiving server checks the signature against that public key to confirm the message has not been altered in transit and genuinely came from a server holding the private key. Frabs does not currently offer a standalone DKIM checker, because doing so requires knowing the exact selector name in use, which varies by mail provider and is not something that can be guessed or discovered through a standard DNS lookup.

Both SPF and DKIM can pass while checking something other than the address displayed to the recipient. DMARC is the piece that requires whichever check passed to actually align with that visible address, and it is the piece that finally tells a receiving server what to do about a mismatch instead of leaving that decision entirely up to individual mail providers.

• No SPF, no DKIM, no DMARC: anyone can send mail claiming to be from this domain, and nothing about the domain's own configuration makes that any harder.
• SPF only: a spoofed message using a different sending server is stopped, but a spoofed message sent through an authorized server with a forged visible address is not.
• SPF and DKIM, no DMARC: both checks can pass individually without ever confirming they relate to the address a recipient actually sees.
• SPF, DKIM and DMARC at reject: the domain itself is difficult to forge directly, though look alike domains registered separately remain entirely outside any of these checks.

Run a domain through the SPF Checker and DMARC Checker to see the current state of both. Between the two, and an MX Lookup to confirm which servers actually handle mail for the domain, you get a reasonably complete picture of how well protected a domain's email actually is against being forged.