--- title: "Email Authentication: SPF, DKIM & DMARC Explained | AutoSPF" description: "How SPF, DKIM and DMARC work together to authenticate email and stop spoofing — plus BIMI and MTA-STS. The complete guide to email authentication." image: "https://autospf.com/images/og-default.png" canonical: "https://autospf.com/email-authentication/" --- The Complete Guide # Email Authentication How SPF, DKIM, and DMARC work together to prove your email is really yours — and stop spoofing. **Email authentication is the set of DNS-based standards that let receiving mail servers verify a message really came from the domain it claims — and reject it when it doesn’t.** Three core standards do the work: SPF authorizes which servers may send for your domain, DKIM adds a cryptographic signature that proves a message wasn’t altered, and DMARC ties both back to the visible From address and tells receivers what to do when a check fails. Together, SPF, DKIM, and DMARC turn an open, trust-nobody protocol into one where inbox providers can tell your legitimate mail apart from spoofs. This hub explains what each standard proves, how they combine into a single layered verdict, and where to go deeper on any one of them. ## Why email authentication exists SMTP, the protocol that carries virtually all email, was designed in an era of mutual trust. It has no built-in way to check that the sender is who they claim to be. Anyone can connect to a mail server and set the From address to anything — your bank, your CEO, or your own domain. Nothing in the base protocol stops them. That gap is exactly what attackers exploit. [Email spoofing](/email-spoofing/) forges the sender address to make a message look legitimate, and phishing campaigns ride on top of it to steal credentials, redirect invoices, or plant malware. Email authentication closes the gap by publishing verifiable signals in DNS — signals a forger cannot fake without control of your domain and your private keys. When those signals are in place and enforced, spoofed mail is detected and rejected before it reaches an inbox. ## SPF, DKIM and DMARC at a glance Each standard answers a different question, and each lives in a different place. Here is how they line up. | Standard | What it proves | Where it lives | | -------------------------------------- | ----------------------------------------------------------------------------------------- | ----------------------------------------------------------------------- | | [SPF](/spf-record-format/) | The connecting server is authorized to send for your domain | A TXT record in your domain’s DNS | | [DKIM](/dkim/) | The message carries a valid cryptographic signature and wasn’t altered in transit | A signature header on the message, verified against a public key in DNS | | [DMARC checker](/tools/dmarc-checker/) | SPF and/or DKIM pass _and_ align with the visible From domain, plus a policy for failures | A TXT record in DNS, applied by the receiver | SPF and DKIM each validate one piece of the puzzle. DMARC is the layer that decides whether those pieces actually protect the address your recipients see. ## How the three work together The three standards form a layered check that a receiving server runs on every message. First, **SPF** looks at the IP address that connected and asks whether your domain’s SPF record authorizes it to send. This validates the envelope — the server, not the message. Second, **DKIM** verifies the cryptographic signature attached to the message against the public key published in your DNS. A valid signature proves the message body and key headers were not tampered with after signing. Third, **DMARC** ties both results back to the domain your recipients actually see in the From field. It requires _alignment_: the domain that passed SPF or DKIM must match the From domain. This matters because a spoofer can easily pass SPF or DKIM for a domain _they_ control — alignment is what forces the check onto _your_ domain. Crucially, **DMARC needs at least one of SPF or DKIM to pass and align.** DMARC on its own authenticates nothing; it is the policy and alignment layer that gives SPF and DKIM teeth. When alignment fails, DMARC applies your published enforcement: `none` (monitor only), `quarantine` (route to spam), or `reject` (refuse the message outright). Moving from `none` to `reject` is how you go from watching spoofs to blocking them. ## Comparing them one-to-one Because the three standards overlap in purpose but differ in mechanism, it helps to compare them in pairs. Each guide below drills into one comparison — what each proves, where they differ, and why you generally need both. - [SPF vs DKIM](/email-authentication/spf-vs-dkim/) — server authorization versus message signing. - [DKIM vs DMARC](/email-authentication/dkim-vs-dmarc/) — signing versus alignment and policy. - [SPF vs DMARC](/email-authentication/spf-vs-dmarc/) — path authorization versus enforcement. ## Beyond the big three Two newer standards build on top of an authenticated foundation. **BIMI** (Brand Indicators for Message Identification) lets your verified logo appear next to authenticated messages in supporting inboxes. It only works once DMARC is enforced at `quarantine` or `reject`, so it’s a reward for getting the fundamentals right rather than a replacement for them. Learn more in the [BIMI](/email-authentication/bimi/) guide. **MTA-STS** (Mail Transfer Agent Strict Transport Security) protects mail _in transit_ by telling sending servers to require TLS encryption and reject downgrade attacks that would otherwise expose messages to interception. Where SPF, DKIM, and DMARC verify the sender, MTA-STS secures the connection itself. See the [MTA-STS](/email-authentication/mta-sts/) guide for setup. ## Getting all three right You don’t have to guess whether your records are valid. Build and verify each layer with a dedicated tool: check your sender policy with the [SPF Checker](/tools/spf-checker/), confirm your signature is published and parsing with the [DKIM Lookup](/tools/dkim-lookup/), and validate alignment and policy with the [DMARC checker](/tools/dmarc-checker/). The single most common thing that quietly breaks a setup is an SPF record that exceeds the **10-lookup limit**. Every `include`, `a`, `mx`, and redirect in your record counts, and once you pass ten DNS lookups, SPF returns a permerror — legitimate mail starts failing authentication even though the record looks fine. [AutoSPF](/) prevents this automatically by flattening your record into a compact, always-valid set of IPs and keeping it under the limit as your senders change, so this failure mode never resurfaces. ## Frequently Asked Questions ### What is email authentication? Email authentication is a group of DNS-based standards — chiefly SPF, DKIM, and DMARC — that let receiving mail servers verify a message genuinely came from the domain it claims to represent. Because SMTP has no built-in sender verification, these standards publish signals that forgers can’t fake, letting inbox providers detect and block spoofed or phishing messages. ### What is the difference between SPF, DKIM and DMARC? SPF authorizes which servers may send mail for your domain. DKIM adds a cryptographic signature proving a message wasn’t altered in transit. DMARC ties both results to the visible From address through alignment and tells receivers what to do when checks fail. SPF and DKIM each validate one piece; DMARC combines them into an enforceable policy. ### Do I need all three of SPF, DKIM and DMARC? Yes. SPF and DKIM each cover only part of the picture, and DMARC requires at least one of them to pass and align before it can protect the address recipients actually see. Skipping any layer leaves a gap: without DMARC there’s no enforcement, and without SPF or DKIM there’s nothing for DMARC to align against. ### Which should I set up first — SPF, DKIM or DMARC? Start with SPF, since it’s the simplest to publish and other layers depend on it. Add DKIM next so messages carry a verifiable signature. Deploy DMARC last, beginning at policy `none` to monitor reports, then tighten to `quarantine` and finally `reject` once you’ve confirmed your legitimate mail passes and aligns. Compare & Go Deeper ## SPF, DKIM, DMARC & Beyond [ SPF vs DKIM → What each method actually verifies — and why you need both. ](/email-authentication/spf-vs-dkim/)[ DKIM vs DMARC → An auth method vs the policy layer built on top of it. ](/email-authentication/dkim-vs-dmarc/)[ SPF vs DMARC → Authorizing servers vs enforcing on the visible From. ](/email-authentication/spf-vs-dmarc/)[ BIMI → Your logo in the inbox — the reward for DMARC enforcement. ](/email-authentication/bimi/)[ MTA-STS → Enforcing encrypted TLS delivery, plus TLS-RPT reporting. ](/email-authentication/mta-sts/) The individual guides: [SPF](/spf-record-format/), [DKIM](/dkim/), and how to [create an SPF record](/how-to-create-an-spf-record/) or [prevent email spoofing](/email-spoofing/). Check your setup with the [SPF Checker](/tools/spf-checker/), [DKIM Lookup](/tools/dkim-lookup/), and [DMARC checker](/tools/dmarc-checker/). ## Authentication only works if SPF stays valid AutoSPF keeps your SPF record flattened and under the 10-lookup limit, so SPF, DKIM and DMARC alignment never silently break. [Start Free Trial→](https://subscriptions.zoho.com/subscribe/31162770c20bc42aba9c86185ed6106a6a2bba0f6b053217ad482bf477cf719e/smb%5F1)[View Plans & Pricing](/pricing/) Rated 5/5 on G2 · Trusted since 2018 ## What Our Customers Say ### "AutoSPF Flattens SPF Records Seamlessly & Keeps Changes Logged - I am quite pleased with the product" > It does what it promises to do, and does it very well. I appreciate that it keeps a log of changes made, which prevents many mistakes. A client's SPF record would have way too many lookups, but AutoSPF makes that problem go away. The length of the SPF record is typically not the issue; it's the amount of lookups in the record that are. AutoSPF "flattens" the record, automatically expanding the defined lookups to IP addresses or ranges. And it auto-updates the record when the un-flattened lookups change. PJ Peter J. President · Small-Business (50 or fewer emp.) ### "Helped us go beyond capacity" > AutoSPF did exactly as described, it helped us get past our 10 lookup limit. Afterwards, we hit another limit regarding overall capacity and when contacted, they quickly provided us with a new solution to eliminate capacity issues entirely going forward, so now we can add as many SPF records as needed. They also provided us with a personalized support video explaining their new method in its entirety using our instance as the example. VU Verified User Financial Services · Mid-Market (51-1000 emp.) [Read our reviews on G2 ](https://www.g2.com/products/autospf/reviews) ```json {"@context":"https://schema.org","@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897474","name":"AutoSPF","url":"https://autospf.com","logo":{"@type":"ImageObject","url":"https://autospf.com/images/autospf-logo.png"},"description":"Automatic SPF flattening and email authentication management. Resolve SPF lookup limits, flatten SPF records, and maintain email deliverability across all your domains.","parentOrganization":{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138883901","name":"DuoCircle LLC","url":"https://www.duocircle.com","sameAs":["https://www.wikidata.org/wiki/Q138883901","https://www.crunchbase.com/organization/duocircle-llc","https://www.linkedin.com/company/duocircle","https://github.com/duocircle"],"subOrganization":[{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138898167","name":"DMARC Report","url":"https://dmarcreport.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897474","name":"AutoSPF","url":"https://autospf.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897912","name":"Phish Protection","url":"https://www.phishprotection.com"}]},"sameAs":["https://www.wikidata.org/wiki/Q138897474","https://www.linkedin.com/company/autospf","https://x.com/autospf01","https://www.facebook.com/autospf","https://github.com/duocircle","https://www.g2.com/products/autospf/reviews"],"aggregateRating":{"@type":"AggregateRating","ratingValue":"5.0","reviewCount":"21","bestRating":"5","worstRating":"1","url":"https://www.g2.com/products/autospf/reviews"},"contactPoint":{"@type":"ContactPoint","contactType":"customer support","url":"https://autospf.com/contact-us/"},"knowsAbout":["SPF Record Flattening","Sender Policy Framework","Email Authentication","DNS Management","DMARC","DKIM","Email Deliverability","SPF Lookup Limits"]} ``` ```json {"@context":"https://schema.org","@type":"WebSite","name":"AutoSPF","url":"https://autospf.com","description":"Automatic SPF flattening and email authentication management. Resolve SPF lookup limits, flatten SPF records, and maintain email deliverability across all your domains.","publisher":{"@type":"Organization","name":"AutoSPF","url":"https://autospf.com","logo":{"@type":"ImageObject","url":"https://autospf.com/images/autospf-logo.png"},"description":"Automatic SPF flattening and email authentication management. Resolve SPF lookup limits, flatten SPF records, and maintain email deliverability across all your domains.","parentOrganization":{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138883901","name":"DuoCircle LLC","url":"https://www.duocircle.com","sameAs":["https://www.wikidata.org/wiki/Q138883901","https://www.crunchbase.com/organization/duocircle-llc","https://www.linkedin.com/company/duocircle","https://github.com/duocircle"],"subOrganization":[{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138898167","name":"DMARC Report","url":"https://dmarcreport.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897474","name":"AutoSPF","url":"https://autospf.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897912","name":"Phish Protection","url":"https://www.phishprotection.com"}]}}} ``` ```json {"@context":"https://schema.org","@type":"FAQPage","mainEntity":[{"@type":"Question","name":"What is email authentication?","acceptedAnswer":{"@type":"Answer","text":"Email authentication is a group of DNS-based standards — chiefly SPF, DKIM, and DMARC — that let receiving mail servers verify a message genuinely came from the domain it claims to represent. Because SMTP has no built-in sender verification, these standards publish signals that forgers can't fake, letting inbox providers detect and block spoofed or phishing messages."}},{"@type":"Question","name":"What is the difference between SPF, DKIM and DMARC?","acceptedAnswer":{"@type":"Answer","text":"SPF authorizes which servers may send mail for your domain. DKIM adds a cryptographic signature proving a message wasn't altered in transit. DMARC ties both results to the visible From address through alignment and tells receivers what to do when checks fail. SPF and DKIM each validate one piece; DMARC combines them into an enforceable policy."}},{"@type":"Question","name":"Do I need all three of SPF, DKIM and DMARC?","acceptedAnswer":{"@type":"Answer","text":"Yes. SPF and DKIM each cover only part of the picture, and DMARC requires at least one of them to pass and align before it can protect the address recipients actually see. Skipping any layer leaves a gap: without DMARC there's no enforcement, and without SPF or DKIM there's nothing for DMARC to align against."}},{"@type":"Question","name":"Which should I set up first — SPF, DKIM or DMARC?","acceptedAnswer":{"@type":"Answer","text":"Start with SPF, since it's the simplest to publish and other layers depend on it. Add DKIM next so messages carry a verifiable signature. Deploy DMARC last, beginning at policy `none` to monitor reports, then tighten to `quarantine` and finally `reject` once you've confirmed your legitimate mail passes and aligns."}}]} ``` ```json {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://autospf.com/"},{"@type":"ListItem","position":2,"name":"Email Authentication","item":"https://autospf.com/email-authentication/"}]} ``` ```json {"@context":"https://schema.org","@type":"Product","name":"AutoSPF","url":"https://autospf.com","aggregateRating":{"@type":"AggregateRating","ratingValue":5,"reviewCount":21,"bestRating":5,"worstRating":1},"review":[{"@type":"Review","reviewRating":{"@type":"Rating","ratingValue":5,"bestRating":5},"author":{"@type":"Person","name":"Peter J.","jobTitle":"President"},"datePublished":"2026-03-10","reviewBody":"It does what it promises to do, and does it very well. I appreciate that it keeps a log of changes made, which prevents many mistakes. A client's SPF record would have way too many lookups, but AutoSPF makes that problem go away. The length of the SPF record is typically not the issue; it's the amount of lookups in the record that are. AutoSPF \"flattens\" the record, automatically expanding the defined lookups to IP addresses or ranges. And it auto-updates the record when the un-flattened lookups change.","name":"AutoSPF Flattens SPF Records Seamlessly & Keeps Changes Logged - I am quite pleased with the product","publisher":{"@type":"Organization","name":"G2","url":"https://www.g2.com"}},{"@type":"Review","reviewRating":{"@type":"Rating","ratingValue":5,"bestRating":5},"author":{"@type":"Person","name":"Verified User","jobTitle":"Financial Services"},"datePublished":"2025-07-31","reviewBody":"AutoSPF did exactly as described, it helped us get past our 10 lookup limit. Afterwards, we hit another limit regarding overall capacity and when contacted, they quickly provided us with a new solution to eliminate capacity issues entirely going forward, so now we can add as many SPF records as needed. They also provided us with a personalized support video explaining their new method in its entirety using our instance as the example.","name":"Helped us go beyond capacity","publisher":{"@type":"Organization","name":"G2","url":"https://www.g2.com"}}]} ```