Table of Contents
SPF DKIM DMARC are the three email authentication standards, written as SPF, DKIM and DMARC, that prove a message genuinely comes from your domain. SPF lists authorized sending servers, DKIM signs each message cryptographically, and DMARC tells receivers what to do when a check fails. Together they protect deliverability and stop spoofing. This guide explains each one and how it pairs with email verification.
Authenticate plus verify — clean your list free.
Verify an Email Free →Free plan included · No credit card · Validate addresses in seconds
What Are SPF, DKIM and DMARC?
SPF, DKIM and DMARC are three email authentication standards that together prove a message genuinely comes from your domain. SPF authorizes the servers allowed to send mail for the domain, DKIM cryptographically signs each message, and DMARC sets the policy for what happens when those checks fail. Mailbox providers use the trio to trust legitimate mail and fight spoofing.
- SPF: Sender Policy Framework publishes, in DNS, the list of servers permitted to send mail for a domain. Receiving servers compare the sending IP against that list and flag any message originating from an unlisted server.
- DKIM: DomainKeys Identified Mail attaches a cryptographic signature to every outgoing message, which receivers verify against a public key in DNS. A valid signature proves the message was not altered in transit and truly came from the domain.
- DMARC: Domain-based Message Authentication ties SPF and DKIM together, tells receivers how to treat failures, and sends back reports. It turns two passive checks into an enforceable, monitored policy for the whole domain.
- Alignment: DMARC requires the authenticated domain to match the visible From address, a test called alignment. That match is what stops a message from passing SPF or DKIM under one domain while spoofing another in the header.
- DNS foundation: All three standards live as DNS records the domain owner publishes, so receivers worldwide read the same authoritative source. That shared lookup lets any mailbox provider apply the policy consistently without contacting the sender directly.
SPF, DKIM and DMARC together prove a message is really yours, forming the foundation of sender trust that providers rely on before delivering mail to the inbox.
Why Does Email Authentication Matter?
Email authentication matters because mailbox providers increasingly require it to reach the inbox, and unauthenticated mail is treated as suspicious and often filtered or rejected. Authentication also stops spammers from spoofing a domain, protecting both deliverability and brand reputation. Without SPF, DKIM and DMARC, even a clean, well-verified list can struggle to land.
- Inbox requirement: Major providers now demand authentication from bulk senders, so unsigned or unaligned mail meets stricter filtering. Domains that publish full SPF, DKIM and DMARC clear that bar and earn the provider trust that placement depends on.
- Anti-spoofing protection: Authentication stops bad actors from forging a domain in the From header, since spoofed messages fail the published checks. That protection shields recipients from phishing sent in the domain’s name and preserves the brand’s sending reputation.
Providers now require authentication, and without it even clean mail gets filtered as suspicious, so the trio is a baseline rather than an optional extra.
What Is SPF?
SPF, the Sender Policy Framework, is a DNS record that lists the servers authorized to send mail for a domain. When a message arrives, the receiving server checks whether the sending server appears on that list. If it does not, the message fails SPF and looks like spoofing, which weakens its chance of reaching the inbox.
- DNS record: SPF lives as a TXT record in the domain’s DNS zone, where it declares which mail servers may send on the domain’s behalf. Receiving servers read that record during delivery to decide whether the sending IP is authorized.
- Authorized servers: The record enumerates every legitimate sender, from the mail platform to any third-party tools used for marketing or transactional mail. Listing each authorized source keeps real mail passing while exposing forged messages sent from unlisted servers.
- IP-based check: SPF evaluates the connecting server’s IP address against the published list rather than inspecting the message body. That path-level test confirms the sending infrastructure is approved before a receiver weighs the content at all.
- Envelope sender: SPF validates the return-path domain in the SMTP envelope, not the visible From header that readers see. That distinction explains why a message can pass SPF yet still need DMARC alignment to truly count.
- Lookup limit: The SPF standard caps the record at ten DNS lookups, so an overloaded record fails and breaks authentication silently. Keeping the record lean prevents that limit from quietly disabling protection for the whole domain.
SPF is a DNS list of who may send for a domain, so mail from any server outside that list fails the check and signals a likely spoof.
What Is DKIM?
DKIM, DomainKeys Identified Mail, adds a cryptographic signature to each outgoing message that receivers verify against a public key published in the domain’s DNS. A valid signature proves the message was not altered in transit and genuinely came from the domain, giving receivers a tamper-evident way to trust the sender beyond an IP check.
- Cryptographic signature: DKIM signs selected message headers and the body with a private key held by the sender, then receivers validate that signature using the matching public key in DNS. The math confirms the message is authentic without exposing the private key.
- Tamper-proof transit: Because the signature covers the content, any modification in transit breaks the verification and reveals tampering. That integrity check protects recipients from altered messages and reassures providers that signed mail arrived exactly as it was sent.
Verifying addresses before a send checks deliverability while authentication proves the sender.
— Hunter, Email Verifier API documentation
DKIM signs each message so receivers can confirm it is unaltered and genuinely from the domain, adding a content-level proof that an IP check alone cannot provide.
What Is DMARC?
DMARC, Domain-based Message Authentication, ties SPF and DKIM together and tells receivers what to do when a message fails: take no action, quarantine it, or reject it outright. It also sends aggregate reports, giving the domain owner visibility into exactly who is sending mail using the domain and how those messages perform.
- Failure policy: DMARC lets the domain owner declare a policy of none, quarantine, or reject for mail that fails alignment with SPF or DKIM. That instruction tells every receiver how to treat unauthenticated mail claiming the domain.
- Reporting visibility: DMARC asks receivers to return aggregate reports on the mail they see from the domain, exposing both legitimate senders and spoofing attempts. Those reports let the owner tighten policy safely once every real source is authenticated.
- Alignment requirement: DMARC passes only when the SPF or DKIM domain matches the visible From domain, a rule called alignment. That check closes the gap where a message passes a raw SPF test while still forging the header.
- Phased rollout: DMARC supports a gradual path from a monitoring policy of none toward strict quarantine or reject. Starting in monitoring mode lets the owner catch misconfigured senders before enforcement blocks any legitimate mail.
- Subdomain coverage: A DMARC record can extend its policy to subdomains, preventing attackers from spoofing an unused subdomain of the brand. That coverage hardens the entire namespace rather than the primary domain alone.
DMARC sets the failure policy and reports back, acting as the enforcement and monitoring layer over the SPF and DKIM checks beneath it.
How Do SPF, DKIM and DMARC Work Together?
SPF checks the sending server, DKIM checks message integrity, and DMARC decides the outcome and reports it. A message passes when it aligns with SPF or DKIM under the published DMARC policy. The three standards are layers of one authentication system rather than competing alternatives, each covering a gap the others leave open.
How SPF DKIM DMARC Layer Together
- SPF checks the server: The receiver first confirms the sending server is authorized in the domain’s SPF record, validating the path the message traveled. This step answers whether the message left an approved server for the domain.
- DKIM checks integrity: The receiver then validates the DKIM signature against the public key in DNS, confirming the message content was not altered. This step answers whether the message arrived intact and genuinely signed by the domain.
- DMARC verifies alignment: DMARC then confirms that the SPF or DKIM domain matches the visible From address, the alignment test that distinguishes a genuine sender from a forged header. Only an aligned pass satisfies the policy.
- Policy applies the outcome: Based on alignment, DMARC instructs the receiver to deliver, quarantine, or reject the message according to the owner’s published policy. This step converts the two checks into a concrete delivery decision.
- Reports close the loop: DMARC finally returns aggregate reports to the domain owner, exposing which sources pass and which fail. Those reports feed back into tighter records, completing a self-correcting authentication cycle for the domain.
SPF, DKIM and DMARC are layers of one system: server check, integrity check, then policy and reporting, each handling a part of the trust decision the others cannot.
How Do They Relate to Email Verification?
Authentication proves who you are, while verification proves who you send to. They solve different halves of deliverability: SPF, DKIM and DMARC stop spoofing and earn provider trust, whereas verification keeps bounces and spam complaints low by confirming addresses are real. Strong inbox placement needs both layers working in parallel, not one in place of the other.
Verifying addresses before sending cuts bounces, while authentication earns the provider trust those clean sends still need.
— Growth Hack Suite, pre-send verification workflow
Authentication proves who you are and verification proves who you send to, so reliable deliverability depends on running both checks together rather than choosing between them.
Authentication vs Verification: What’s the Difference?
Authentication through SPF, DKIM and DMARC validates the sender and the message, while verification validates the recipient addresses. One protects against spoofing and builds provider trust; the other protects against bounces and complaints by removing bad addresses. The table below contrasts the two halves of deliverability on the points that matter most.
Source: SPF/DKIM/DMARC roles per RFC 7208 (SPF), RFC 6376 (DKIM), RFC 7489 (DMARC) and Wikipedia, verified 2026-06-29.
Authentication validates the sender and verification validates the recipients, so the two are complementary halves of one deliverability goal rather than substitutes.
How Common Is Full Authentication?
Full authentication has risen sharply since major providers began requiring it for bulk senders, yet many smaller senders still lack a complete SPF, DKIM and DMARC setup. Missing or partial authentication is now a common, often invisible cause of poor deliverability, because the sender sees no error while messages quietly land in spam.
- Now often required: Large mailbox providers have made authentication a condition for bulk delivery, pushing adoption upward across professional senders. Domains that meet the requirement reach the inbox more reliably than those still sending unauthenticated mail.
- Still missing for many: Plenty of small businesses and individual senders publish SPF but skip DKIM or DMARC, leaving the chain incomplete. That gap weakens trust silently, since partial authentication still allows spoofing the policy layer would have caught.
Authentication is increasingly required yet still missing for many senders, making an incomplete setup a hidden but fixable deliverability gap.
How Do You Set Up SPF, DKIM and DMARC?
Set up each standard as a DNS record: publish an SPF record listing your senders, enable DKIM signing in your email platform and add its public key, then add a DMARC record starting with a monitoring policy. Verify your lists in parallel so authenticated mail also reaches valid addresses rather than bouncing off dead ones.
- Publish SPF: Add a TXT record that names every server and service authorized to send for the domain, then test that legitimate mail passes. A complete record prevents real senders from failing while still exposing forged sources.
- Enable DKIM: Turn on DKIM signing in the email platform, generate a key pair, and publish the public key in DNS as the platform directs. Confirm outgoing messages carry a valid signature before relying on it for trust.
- Add a DMARC policy: Start with a DMARC record set to a monitoring policy of none with reporting enabled, read the reports until every real sender aligns, then tighten to quarantine or reject. Phasing the policy prevents blocking legitimate mail.
Verify your list free alongside authentication.
Verify an Email Free →Free plan · No credit card · Clean addresses before you send
Publish SPF, enable DKIM, and add a phased DMARC policy, then verify your lists so authenticated mail actually reaches valid inboxes instead of bouncing.
What Tools Help With Authentication and Hygiene?
DNS and DMARC-monitoring tools handle the authentication side, while a verifier handles list hygiene. Hunter covers the verification half on a recurring free tier, confirming addresses are real before a send. The table below shows how authentication tools and verification tools complement each other across the deliverability stack.
Source: hunter.io/pricing, verified 2026-06-29 (free plan 50 credits/mo = ~100 verifications). Other rows describe common tool categories; confirm each provider’s free tier before relying on it.
DMARC tools handle the authentication side and a verifier handles the hygiene side, so both belong in a stack built for reliable inbox placement.
Verdict: Why SPF, DKIM and DMARC Matter
SPF, DKIM and DMARC are the authentication standards that prove a message is genuinely yours, now effectively required to reach the inbox. They protect against spoofing and earn provider trust, but they do not clean your list. Pair authentication with verification to cover both halves of deliverability and keep mail landing where it should.
Verdict: SPF, DKIM and DMARC are the three authentication standards now effectively required to reach the inbox. They stop spoofing and earn provider trust, but they do not clean a list. Pair authentication with verification for full deliverability.
DMARC is an email authentication protocol designed to give domain owners protection from spoofing.
— Wikipedia, DMARC
Verify your list free to complete your deliverability setup.
Verify an Email Free →Free plan · No credit card · Authentication plus clean addresses
Related Tools in the Hunter Stack
Authentication and verification together protect deliverability, but they address different problems. The Hunter Email Verifier review covers the hygiene half, showing how each address status is decided, while the finder review covers building the lists worth verifying in the same connected stack on one credit pool. Sender reputation, the wider picture both feed into, is covered separately.
- Hunter Email Verifier: The hygiene layer that confirms each address before a send and pairs with authentication for clean delivery — start with what the Hunter Email Verifier is.
- Hunter Email Finder: The list-building half of the bundle that shares the same credit pool — read the Hunter.io email finder review for sourcing costs.
SPF, DKIM and DMARC: Frequently Asked Questions
The 12 most-asked questions about SPF, DKIM and DMARC.
What are SPF, DKIM and DMARC?
SPF, DKIM and DMARC are three email authentication standards that together prove a message genuinely comes from your domain. SPF lists the servers authorized to send for the domain, DKIM cryptographically signs each message, and DMARC sets the policy for failures and reports back. Mailbox providers use the trio to trust legitimate mail and block spoofing.
Why does email authentication matter?
Authentication matters because mailbox providers increasingly require it to reach the inbox, and unauthenticated mail is treated as suspicious and often filtered. It also stops spammers from spoofing your domain, protecting deliverability and brand reputation. Without SPF, DKIM and DMARC, even a clean, well-verified list can struggle to land.
What is SPF?
SPF, the Sender Policy Framework, is a DNS record listing the servers authorized to send mail for a domain. When a message arrives, the receiver checks whether the sending server is on that list. If not, the mail fails SPF and looks like spoofing, hurting its chance of reaching the inbox.
What is DKIM?
DKIM, DomainKeys Identified Mail, adds a cryptographic signature to each message that receivers verify against a public key in your DNS. A valid signature proves the message was not altered in transit and genuinely came from your domain, giving receivers a tamper-evident way to trust the sender beyond an IP check.
What is DMARC?
DMARC ties SPF and DKIM together and tells receivers what to do when a message fails: none, quarantine, or reject. It also sends aggregate reports, giving the domain owner visibility into who sends mail using the domain. DMARC is the enforcement and monitoring layer over the two checks beneath it.
How do they work together?
SPF checks the sending server, DKIM checks message integrity, and DMARC decides the outcome and reports it. A message passes when it aligns with SPF or DKIM under the DMARC policy. The three are layers of one authentication system, not competing alternatives, each covering a gap the others leave open.
How do they relate to verification?
Authentication proves who you are, while verification proves who you send to. Authentication stops spoofing and earns provider trust; verification keeps bounces and complaints low by confirming addresses are real. They solve different halves of deliverability, so strong inbox placement needs both layers running together.
Authentication vs verification?
Authentication through SPF, DKIM and DMARC validates the sender and message; verification validates the recipient addresses. One protects against spoofing and builds trust, the other protects against bounces and complaints. They are complementary halves of one deliverability goal rather than substitutes for each other.
How common is full authentication?
Adoption has risen sharply since major providers began requiring authentication for bulk senders, yet many small senders still lack a complete SPF, DKIM and DMARC setup. Missing or partial authentication is now a common, often invisible cause of poor deliverability, since the sender sees no error while mail quietly lands in spam.
How do I set up SPF, DKIM and DMARC?
Set up each as a DNS record: publish an SPF record listing your senders, enable DKIM signing in your email platform and add its public key, then add a DMARC record starting with a monitoring policy. Verify your lists in parallel so authenticated mail also reaches valid addresses instead of bouncing.
What tools help with authentication?
DNS and DMARC-monitoring tools handle the authentication side, while a verifier handles list hygiene. DMARC tools collect reports and track alignment, record checkers look up SPF, DKIM and DMARC entries, and a verifier like Hunter confirms addresses are real on a recurring free tier. Both sides belong in a deliverability stack.
Do I need both authentication and verification?
Yes. Authentication and verification solve different halves of deliverability, so doing only one leaves a gap. Authentication stops spoofing and earns provider trust, but it does not remove dead addresses; verification keeps bounces and complaints low, but it does not prove the sender. Running both keeps mail authenticated and landing in real inboxes.
