--- title: "How do SPF and DMARC work together to enhance email security? | AutoSPF" description: "Email channels were never considered a safe means of communication, and with the growing sophistication of artificial intelligence and machine learning." image: "https://autospf.com/og/blog/how-spf-dmarc-work-together-to-improve-email-security.png" canonical: "https://autospf.com/blog/how-spf-dmarc-work-together-to-improve-email-security/" --- Quick Answer Email channels were never considered a safe means of communication, and with the growing sophistication of artificial intelligence and machine learning, they’re being exploited even more. That’s the reason why a staggering 93% of organizations are now planning to strengthen their email security, driven by the rising threat of AI-powered phishing attacks. How do SPF and DMARC work together to enhance email security? Your browser does not support the audio element. [ Download episode](/audio/how-spf-dmarc-work-together-to-improve-email-security.mp3) ## Try Our Free DMARC Checker Validate your DMARC policy, check alignment settings, and verify reporting configuration. [ Check DMARC Record → ](/tools/dmarc-checker/) Share [ ](https://www.linkedin.com/sharing/share-offsite/?url=https%3A%2F%2Fautospf.com%2Fblog%2Fhow-spf-dmarc-work-together-to-improve-email-security%2F "Share on LinkedIn") [ ](https://twitter.com/intent/tweet?text=How%20do%20SPF%20and%20DMARC%20work%20together%20to%20enhance%20email%20security%3F&url=https%3A%2F%2Fautospf.com%2Fblog%2Fhow-spf-dmarc-work-together-to-improve-email-security%2F "Share on X/Twitter") [ ](https://www.facebook.com/sharer/sharer.php?u=https%3A%2F%2Fautospf.com%2Fblog%2Fhow-spf-dmarc-work-together-to-improve-email-security%2F "Share on Facebook") [ ](https://reddit.com/submit?url=https%3A%2F%2Fautospf.com%2Fblog%2Fhow-spf-dmarc-work-together-to-improve-email-security%2F&title=How%20do%20SPF%20and%20DMARC%20work%20together%20to%20enhance%20email%20security%3F "Share on Reddit") [ ](mailto:?subject=How%20do%20SPF%20and%20DMARC%20work%20together%20to%20enhance%20email%20security%3F&body=Check out this article: https%3A%2F%2Fautospf.com%2Fblog%2Fhow-spf-dmarc-work-together-to-improve-email-security%2F "Share via Email") ![email security](https://media.mailhop.org/autospf/images/2025/09/spf-flattening-6399.jpg) Email channels were never considered a safe means of communication, and with the growing sophistication of artificial intelligence and machine learning, they’re being exploited even more. _DMARC ([RFC 7489](https://datatracker.ietf.org/doc/html/rfc7489)) ties SPF and DKIM together by requiring alignment between the envelope sender and the visible `From` header. According to Google’s February 2024 bulk sender requirements, a DMARC policy of at least `p=none` is now mandatory for any domain sending 5,000+ messages per day to Gmail users._ For a complete overview, see our [comprehensive DMARC guide](/blog/what-is-dmarc-email-authentication-guide/). That’s the reason why a staggering [93% of organizations](https://securitybrief.news/story/organisations-battle-with-ai-driven-phishing-threat-rise) are now planning to strengthen their email security, driven by the rising threat of [AI-powered phishing attacks](https://thehackernews.com/2025/06/iranian-apt35-hackers-targeting-israeli.html). This is in situations like this where the powerful combination of SPF and DMARC works together to form a critical and proactive defense layer that essentially prevents [threat actors](https://cybersecuritynews.com/iranian-threat-actors-attacking-u-s-critical-infrastructure/) from succeeding in email [spoofing and phishing](https://www.msspalert.com/brief/novel-usps-spoofing-phishing-attack-relies-on-malicious-pdfs) attacks attempted in your company’s name. This blog explains how that is done. ![AI-powered phishing attacks ](https://media.mailhop.org/autospf/images/2025/09/spf-validator-5844.jpg) ## The basics of SPF Your domain is undoubtedly your [brand’s identity](https://www.investopedia.com/terms/b/brand-identity.asp). Since it’s so critical for your business, you would want only the right people to send emails from it, so that your customers or prospects don’t get duped with [fake emails](https://www.usatoday.com/story/money/columnist/2023/09/21/ai-cyber-scams-security/70920106007/) pretending to be from you. This is where SPF steps in and works like a guest list stored in your domain’s DNS. It’s the list in which you explicitly specify which IP addresses are allowed to send emails on behalf of your domain. _So when someone sends an email claiming to be from yourcompany.com, the receiving email server checks your SPF record to see if the sending server’s IP is on the approved list._ ![SPF ](https://media.mailhop.org/autospf/images/2025/09/spf-record-2799.jpg) ### SPF’s limitations [SPF](/blog/what-is-spf-email-a-guide-to-sender-validation-technology/) handles the guest list system well, but it’s not enough on its own. The issue is that when an email is sent directly from your server, SPF works well. However, it breaks on forwarding. So, let’s say your customer forwarded your email to their colleague. Now, in this situation, the forwarded email is not sent from one of the servers mentioned in the [SPF record](/spf-record-checker/create-spf-record/) (the guest list) because it came from the forwarding service’s server. Therefore, when the receiving server performs the SPF authentication checks, the email will not be considered authorized or legitimate. _Since SPF only looks at the IP address of the immediate sender, it doesn’t understand that the email was originally sent by your company and later forwarded._ As a result, legitimate emails can [end up in spam](https://cybernews.com/news/microsofts-breach-notification-emails-end-up-in-spam-folder/) or get rejected, even though you did everything right. ![DMARC](https://media.mailhop.org/autospf/images/2025/09/spf-record-check-7088.jpg) That’s why SPF is a helpful but incomplete solution. To properly defend your domain against spoofing, SPF needs a powerful partner, that is, DMARC. ## The basics of DMARC So far, we’ve seen that SPF helps by telling the world which servers are allowed to send emails from your domain. But we also saw that SPF can get confused when emails are forwarded, and sometimes fake emails can still slip through. This is where DMARC comes to fill the gap. You can imagine [DMARC](https://dmarcreport.com/what-is-dmarc/) as the smart supervisor that sits on top of SPF (and DKIM) to make clear decisions based on specific rules. _What’s interesting is the fact that DMARC doesn’t just say ‘pass’ or ‘fail.’ It instead tells the receiving server what to do with the emails that fail SPF and/or DKIM checks_. Should the emails be delivered as usual, sent to the spam folder, or rejected entirely? Plus, DMARC gives you regular reports. These reports show you who is sending emails using your domain and how many are passing or failing the checks. This helps you spot fake senders trying to spoof your brand and fix problems before they get out of hand. ### How does DMARC use SPF (and DKIM) results? Now let’s break down how DMARC actually makes decisions. When an email arrives, DMARC looks at two things: - The result of the [SPF check](/spf-record-tester/mimecast-spf-check/). - The result of the DKIM check (which is like a [digital signature](https://en.wikipedia.org/wiki/Digital%5Fsignature) proving the email hasn’t been tampered with). ![digital signature ](https://media.mailhop.org/autospf/images/2025/09/spf-record-tester-6311.jpg) But an important twist is that DMARC checks for alignment. This means it doesn’t care only if the SPF check passed; it checks whether the domain in the ‘From’ address (the one people see) matches the domain authorized by SPF or DKIM. For example: _Your company’s domain is yourcompany.com, and an email claims to be from yourcompany.com in the ‘From’ field._ For DMARC to pass, either: - The SPF check must pass, and the domain in the SPF record must exactly match yourcompany.com (this is called SPF alignment) or - The [DKIM signature](https://docs.mapp.com/docs/dkim-signature) must be valid and also aligned with your domain. If neither is aligned, DMARC marks the email as suspicious and tells the receiving server what to do (based on your DMARC policy). So instead of just hoping SPF or [DKIM](/10-reasons-for-regular-spf-record-checks-in-cybersecurity/dkim-record-check/) works, DMARC makes sure the right domain is involved at every step. ![ DKIM works ](https://media.mailhop.org/autospf/images/2025/09/spf-record-syntax-4687.jpg) ## Common pitfalls to avoid _When setting up SPF and DMARC, many people make simple mistakes that can cause big problems_. Let’s look at the most common ones so you can avoid them. ### 1\. Ignoring SPF alignment issues Just having SPF pass is not enough. The domain in the ‘From’ field of your email must match the domain in your SPF record. If they don’t match, DMARC will fail the check. Always double-check that your SPF is aligned with your ‘From’ domain so legitimate emails don’t get blocked. ![Dmarc policy](https://media.mailhop.org/autospf/images/2025/09/spf-checker-2976.jpg) ### 2\. Setting DMARC to ‘p=reject’ too early Many domain owners rush to set their DMARC policy to ‘reject’ too soon. This can block genuine emails if your setup is not yet perfect. _Start with DMARC in ‘monitor’ mode_. Check the reports regularly to understand what is passing and what is failing. Once you are confident, move to ‘reject’ for better protection. ### 3\. Exceeding the DNS lookup limit Your SPF record should not require more than 10 [DNS lookups](https://www.digicert.com/faq/dns/how-does-dns-lookup-work). It simply means that every time a receiving server checks your SPF record, it may need to look up multiple parts of your DNS to confirm which IPs are allowed to send emails. If there are too many lookups, the check fails automatically. ![DNS lookups ](https://media.mailhop.org/autospf/images/2025/09/spf-lookup-5520.jpg) _To avoid this, keep your SPF record simple. Use IP addresses directly when possible, and avoid too many include statements from third parties._ If it’s getting challenging to stay within the lookup limit, use [our automatic SPF flattening tool](/) or [reach out to us](/contact-us/). We will sort it out for you. ## Topics [ DKIM ](/tags/dkim/)[ email security ](/tags/email-security/)[ SPF ](/tags/spf/)[ SPF Flattening ](/tags/spf-flattening/)[ SPF Flattening tool ](/tags/spf-flattening-tool/)[ SPF record ](/tags/spf-record/) ![Brad Slavin](https://media.mailhop.org/autospf/images/authors/brad-slavin.jpg) [ Brad Slavin ](/authors/brad-slavin/) General Manager Founder and General Manager of DuoCircle. Product strategy and commercial lead for AutoSPF's 2,000+ customer base. [LinkedIn Profile →](https://www.linkedin.com/in/bradslavin) ## Ready to get started? Try AutoSPF free — no credit card required. [ Book a Demo ](/book-a-demo/) ## Related Articles [ Intermediate 3m 3 points to consider before setting your SPF record to -all (HardFail) May 22, 2025 ](/blog/3-points-to-consider-before-setting-your-spf-record-hardfail/)[ Intermediate 6m Decoding SPF mechanisms and their role in maximizing email deliverability Nov 6, 2024 ](/blog/decoding-spf-mechanisms-and-their-role-in-maximizing-email-deliverability/)[ Intermediate 6m How often should you audit your SPF record, and what should you look for? Jul 2, 2025 ](/blog/how-often-audit-spf-record-and-what-to-look-for/)[ Intermediate 5m SPF misconfigurations banks must avoid to stay secure Sep 26, 2025 ](/blog/spf-misconfigurations-banks-must-avoid-to-stay-secure/) ```json {"@context":"https://schema.org","@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897474","name":"AutoSPF","url":"https://autospf.com","logo":{"@type":"ImageObject","url":"https://autospf.com/images/autospf-logo.png"},"description":"Automatic SPF flattening and email authentication management. Resolve SPF lookup limits, flatten SPF records, and maintain email deliverability across all your domains.","parentOrganization":{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138883901","name":"DuoCircle LLC","url":"https://www.duocircle.com","sameAs":["https://www.wikidata.org/wiki/Q138883901","https://www.crunchbase.com/organization/duocircle-llc","https://www.linkedin.com/company/duocircle","https://github.com/duocircle"],"subOrganization":[{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138898167","name":"DMARC Report","url":"https://dmarcreport.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897474","name":"AutoSPF","url":"https://autospf.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897912","name":"Phish Protection","url":"https://www.phishprotection.com"}]},"sameAs":["https://www.wikidata.org/wiki/Q138897474","https://www.linkedin.com/company/autospf","https://x.com/autospf01","https://www.g2.com/products/autospf/reviews"],"contactPoint":{"@type":"ContactPoint","contactType":"customer support","url":"https://autospf.com/contact-us/"},"knowsAbout":["SPF Record Flattening","Sender Policy Framework","Email Authentication","DNS Management","DMARC","DKIM"]} ``` ```json {"@context":"https://schema.org","@type":"WebSite","name":"AutoSPF","url":"https://autospf.com","description":"Automatic SPF flattening and email authentication management. Resolve SPF lookup limits, flatten SPF records, and maintain email deliverability across all your domains.","publisher":{"@type":"Organization","name":"AutoSPF","url":"https://autospf.com","logo":{"@type":"ImageObject","url":"https://autospf.com/images/autospf-logo.png"},"description":"Automatic SPF flattening and email authentication management. Resolve SPF lookup limits, flatten SPF records, and maintain email deliverability across all your domains.","parentOrganization":{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138883901","name":"DuoCircle LLC","url":"https://www.duocircle.com","sameAs":["https://www.wikidata.org/wiki/Q138883901","https://www.crunchbase.com/organization/duocircle-llc","https://www.linkedin.com/company/duocircle","https://github.com/duocircle"],"subOrganization":[{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138898167","name":"DMARC Report","url":"https://dmarcreport.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897474","name":"AutoSPF","url":"https://autospf.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897912","name":"Phish Protection","url":"https://www.phishprotection.com"}]}}} ``` ```json {"@context":"https://schema.org","@type":"BlogPosting","headline":"How do SPF and DMARC work together to enhance email security?","description":"Email channels were never considered a safe means of communication, and with the growing sophistication of artificial intelligence and machine learning.","url":"https://autospf.com/blog/how-spf-dmarc-work-together-to-improve-email-security/","datePublished":"2025-09-17T19:38:45.000Z","dateModified":"2026-04-18T02:36:41.000Z","dateCreated":"2025-09-17T19:38:45.000Z","author":{"@type":"Person","@id":"https://autospf.com/authors/brad-slavin/#person","name":"Brad Slavin","url":"https://autospf.com/authors/brad-slavin/","jobTitle":"General Manager","description":"Brad Slavin is the founder and General Manager of DuoCircle, the company behind AutoSPF, DMARC Report, Phish Protection, and Mailhop. He founded DuoCircle in 2014 to solve the SPF 10-DNS-lookup problem at scale and has led the company's growth to 2,000+ customers. Brad's focus is product strategy, customer relationships, and the commercial and compliance side of email authentication (DPAs, SLAs, enterprise procurement) rather than hands-on DNS engineering.","image":"https://media.mailhop.org/autospf/images/authors/brad-slavin.jpg","knowsAbout":["Email Security Strategy","SaaS Product Management","Enterprise Compliance","Customer Success","Email Deliverability Business"],"worksFor":{"@type":"Organization","name":"AutoSPF","url":"https://autospf.com"},"sameAs":["https://www.linkedin.com/in/bradslavin"]},"publisher":{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897474","name":"AutoSPF","url":"https://autospf.com","logo":{"@type":"ImageObject","url":"https://autospf.com/images/autospf-logo.png"},"description":"Automatic SPF flattening and email authentication management. Resolve SPF lookup limits, flatten SPF records, and maintain email deliverability across all your domains.","parentOrganization":{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138883901","name":"DuoCircle LLC","url":"https://www.duocircle.com","sameAs":["https://www.wikidata.org/wiki/Q138883901","https://www.crunchbase.com/organization/duocircle-llc","https://www.linkedin.com/company/duocircle","https://github.com/duocircle"],"subOrganization":[{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138898167","name":"DMARC Report","url":"https://dmarcreport.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897474","name":"AutoSPF","url":"https://autospf.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897912","name":"Phish Protection","url":"https://www.phishprotection.com"}]},"sameAs":["https://www.wikidata.org/wiki/Q138897474","https://www.linkedin.com/company/autospf","https://x.com/autospf01","https://www.g2.com/products/autospf/reviews"],"contactPoint":{"@type":"ContactPoint","contactType":"customer support","url":"https://autospf.com/contact-us/"},"knowsAbout":["SPF Record Flattening","Sender Policy Framework","Email Authentication","DNS Management","DMARC","DKIM"]},"mainEntityOfPage":{"@type":"WebPage","@id":"https://autospf.com/blog/how-spf-dmarc-work-together-to-improve-email-security/"},"articleSection":"intermediate","keywords":"DKIM, email security, SPF, SPF Flattening, SPF Flattening tool, SPF record","wordCount":1143,"image":{"@type":"ImageObject","url":"https://media.mailhop.org/autospf/images/2025/09/spf-flattening-6399.jpg","caption":"email security","width":900,"height":600},"speakable":{"@type":"SpeakableSpecification","cssSelector":[".answer-block","h1"]}} ``` ```json {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://autospf.com/"},{"@type":"ListItem","position":2,"name":"Blog","item":"https://autospf.com/blog/"},{"@type":"ListItem","position":3,"name":"Intermediate","item":"https://autospf.com/intermediate/"},{"@type":"ListItem","position":4,"name":"How do SPF and DMARC work together to enhance email security?","item":"https://autospf.com/blog/how-spf-dmarc-work-together-to-improve-email-security/"}]} ```