Difference Between SPF, DKIM, and DMARC: 2026 Simple Guide

Written by Shamim Sarker

Founder & Chief Senior Software Analyst | 8+ Years Reviewing Email Marketing & Deliverability Software | Expert Reviewed

You hit send on an invoice or a password reset, and it lands in spam. Or worse, a customer forwards you a “payment update” email that looks exactly like yours but didn’t come from you.

Both problems trace back to the same three DNS records. Understanding the difference between SPF, DKIM, and DMARC is how you prove your email is really yours and stop strangers from sending as your domain.

This isn’t optional anymore. Gmail and Yahoo began requiring email authentication for bulk senders in February 2024,^[1][2] and Microsoft’s Outlook.com followed in May 2025.^[7] If you send more than 5,000 messages a day without all three protocols, your mail risks the Junk folder or outright rejection.

Below, you’ll see what each protocol checks, how they work together, and the exact setup order that won’t break your existing email. You’ll also get an honest comparison of three DMARC monitoring tools, with every rating and price labeled by its source.

Try EasyDMARC Free →

What Are SPF, DKIM, and DMARC?

All three are email authentication protocols that live as text records in your domain’s DNS. Each one answers a different question about an incoming message.

SPF vs DKIM vs DMARC: What’s the Difference?

The simplest way to see the difference between SPF, DKIM, and DMARC is to ask what each one checks and what it can do when a check fails. The table below lines them up side by side.

The biggest difference is the domain each protocol looks at. SPF checks the Return-Path, a hidden envelope address, and DKIM checks the domain in its signature’s d= tag. Neither one looks at the From address your recipient actually sees.

That gap is what spoofers exploit, and it’s why DMARC exists. DMARC requires the visible From domain to match, or align with, a domain that passed SPF or DKIM. Without it, a scammer can pass SPF using their own domain while displaying yours.

The other key difference is enforcement. SPF can only hint at a soft or hard fail, and DKIM has no policy at all, so receivers decide for themselves. DMARC is the only one of the three that tells inboxes exactly what to do and reports back to you.

How Each Protocol Works

Definitions only go so far. This section walks through what happens behind the scenes when a mailbox provider checks each record, plus a working example you can adapt.

How Does SPF Work?

When your email arrives, the receiving server reads the Return-Path domain and looks up that domain’s SPF record. It then checks whether the IP address that delivered the message appears in the record, either directly or through an include.

A typical record for a business using Google Workspace plus a transactional email service looks like this:

v=spf1 include:_spf.google.com include:sendgrid.net ~all

v=spf1 marks the version, and each include authorizes one provider’s servers. The closing ~all tells receivers to treat every other source as a soft fail, while a stricter -all signals a hard fail.

How Does DKIM Work?

Before a message leaves, your mail server hashes the body and selected headers, then encrypts that hash with a private key. The result goes into a DKIM-Signature header that names your domain (d=) and a DKIM selector (s=).

The receiver uses those two values to find your public key in DNS:

Host:  google._domainkey.example.com
Type:  TXT
Value: v=DKIM1; k=rsa; p=MIIBIjANBgkqhkiG9w0BAQEFAAOC...

If the decrypted hash matches a fresh hash of the message, DKIM passes. Selectors let you run a separate key for each sending service, and you rarely create keys yourself because Google Workspace, Microsoft 365, and most email platforms generate them for you. Microsoft 365, for example, has you publish two CNAME records instead of a TXT record.

How Does DMARC Work?

DMARC runs last. The receiver takes the SPF and DKIM results, checks whether either passing domain aligns with the From address, then looks up your policy at _dmarc.example.com:

v=DMARC1; p=none; rua=mailto:dmarc-reports@example.com

The p= tag sets your DMARC policy. p=none only monitors, p=quarantine sends failing mail to spam, and p=reject blocks it outright.

The rua= tag tells mailbox providers where to send aggregate reports (RUA), usually once a day. Each report lists the IPs that sent mail as your domain and whether they passed. The reports arrive as raw XML files, which is why most businesses pair DMARC with a monitoring tool instead of reading them by hand.

How SPF, DKIM, and DMARC Work Together

Each protocol runs its own check, but DMARC makes the final call. The diagram below shows the order a receiving server follows for every message that claims to come from your domain.

What Is DMARC Alignment?

DMARC alignment means the domain that passed SPF or DKIM matches the domain in the visible From address. You only need one aligned pass, not both.

Alignment comes in two modes, set with the aspf= and adkim= tags in your DMARC record. Relaxed alignment, the default, accepts any subdomain of the same organizational domain, so news.example.com aligns with example.com. Strict alignment requires an exact match.

Here’s how the results combine:

Row four is the one that catches businesses off guard. A newsletter platform can pass SPF and DKIM using its own domain, yet still fail DMARC because neither domain matches yours. The fix is to set up custom domain authentication inside the platform, which usually means adding a few DNS records it provides.

Can DMARC Pass If SPF Fails?

Yes. DMARC passes when DKIM passes and aligns, even if SPF fails completely. That’s why DKIM is the more dependable of the two for reliable delivery.

Why Does SPF Fail When Email Is Forwarded?

When someone forwards your message, it leaves from the forwarder’s server, whose IP address isn’t in your SPF record. SPF fails through no fault of yours.

A DKIM signature travels inside the message, so it usually survives forwarding intact. It can still break if a mailing list edits the content, for example by adding a footer or changing the subject line.

That’s the gap ARC (Authenticated Received Chain) was built to close. When a forwarder or mailing list supports ARC, it records the authentication results it saw before changing the message, so the final mailbox provider can still trust a message that would otherwise fail. You don’t publish an ARC record yourself; the forwarding service and the receiving inbox handle it.

Strengths and Limitations of SPF, DKIM, and DMARC

No single protocol covers every gap, which is exactly why they’re designed to run together. Here’s what each one does well and where it falls short.

The last two limitations matter most. DMARC protects your exact domain, but it can’t stop a scammer who registers a lookalike such as examp1e.com or types your company name into the display-name field of a free Gmail account.

That’s why security teams pair authentication with staff training and lookalike-domain monitoring. And a DMARC record left at p=none indefinitely only watches your traffic without protecting it.

Do You Need SPF, DKIM, and DMARC? 2026 Requirements

Yes. Gmail now requires every sender, at any volume, to set up SPF or DKIM, and bulk sender requirements at all three major mailbox providers call for SPF, DKIM, and DMARC together.^[1][2]

Microsoft’s original announcement said non-compliant mail would go to Junk first.^[7] Mailgun and dmarcian later reported that Microsoft began rejecting it outright instead, so plan for rejection.

Who Needs DMARC Enforcement Most?

Aligning both SPF and DKIM isn’t required today, but it’s the safest setup: if forwarding breaks one, the other still carries DMARC.

How to Set Up SPF, DKIM, and DMARC Step by Step

Order matters here. Set up SPF first, then DKIM, and add DMARC last in monitoring mode, so you never block your own legitimate email.

How Do You Check Whether Your Records Work?

Send a test email to a Gmail account, open it, and choose Show original from the three-dot menu. You’ll see a PASS or FAIL result for SPF, DKIM, and DMARC at the top.

Other mailbox providers show the same results in the Authentication-Results header as spf=pass, dkim=pass, and dmarc=pass. DNS changes can take up to 48 hours to spread, so retest the next day if a new record doesn’t show up yet.

Best DMARC Tools to Simplify Setup: 2026 Pricing

Reading raw XML reports by hand gets old fast, especially once you have more than one sending service. A DMARC monitoring tool turns those reports into a dashboard that shows who’s sending as your domain and what’s failing.

Prices vary by billing cycle and source, so check the vendor’s page before you buy. EasyDMARC’s pricing page lists the Plus plan at $35.99 a month billed annually or $44.99 month-to-month, and Premium at $71.99 a month billed annually.^[3] G2 shows the same $35.99 to $71.99 range. Capterra lists a lower $17.99 starting price, billed per feature,^[6] so confirm which plan that figure covers before you compare.

PowerDMARC’s Basic plan starts at $8 a month and scales with email volume, up to $250 a month at the top tier, according to a June 2026 capture of its pricing page by DMARCguard, a competing DMARC vendor.

Who Should Skip Each DMARC Tool?

See EasyDMARC Pricing →

On a tight budget? Try Valimail Monitor free to see every service sending as your domain before you pay for anything.

What Users Say About EasyDMARC, PowerDMARC, and Valimail

Review scores for DMARC tools shift from week to week, and different snapshots rarely match. The table below lists each source’s figures, with review counts and dates, so you can judge the sample size yourself.

Across all three tools, customer support is the strength reviewers mention most. EasyDMARC scores 9.6 out of 10 for quality of support on G2,^[4] and support is PowerDMARC’s most-cited tag there too.^[5]

Final Verdict: The Difference Between SPF, DKIM, and DMARC

Frequently Asked Questions

References