DKIM vs DMARC
DKIM is an authentication method - a cryptographic signature proving a message is authorized and unaltered. DMARC is a policy-and-reporting layer built on top of DKIM (and SPF): it checks alignment with the visible From domain and tells receivers what to do on failure. They aren't alternatives.
This guide is part of our guide to email authentication. Related: SPF vs DKIM and SPF vs DMARC.
DKIM is an authentication method: a cryptographic signature that proves a message was authorized by the sending domain and hasn’t been altered in transit. DMARC is a policy-and-reporting layer that uses DKIM (and SPF) results, checks whether they align with the visible From domain, and tells receivers what to do when a message fails. They are not alternatives — DMARC is built on top of DKIM.
What DKIM does
DKIM (DomainKeys Identified Mail) lets a sending server attach a cryptographic signature to every outgoing message. The server signs selected headers and the body with a private key, and receivers verify that signature against a public key published in the sending domain’s DNS. If the verification succeeds, the receiver knows two things: the message was authorized by a domain that controls the signing key, and the signed content was not modified between sending and delivery.
That signature travels in a hidden header called the DKIM signature. It records which domain signed the message, which selector points to the public key, and which headers were covered. Crucially, DKIM by itself only answers “is this signature valid?” It does not decide what a receiver should do with an unsigned or invalid message, and it does not report anything back to the domain owner. It is a verification mechanism, not an enforcement or monitoring system.
What DMARC does
DMARC (Domain-based Message Authentication, Reporting and Conformance) sits one level up. It doesn’t sign or verify messages itself — instead, it consumes the pass/fail results from DKIM and SPF and adds three things they lack.
First, alignment. DMARC requires that a passing DKIM (or SPF) result belong to the same domain a human sees in the From header. A valid signature from an unrelated domain doesn’t satisfy DMARC. This closes the gap that lets attackers pass authentication while still spoofing your brand.
Second, policy. A DMARC record published in DNS tells receivers how to treat messages that fail alignment: p=none (monitor only), p=quarantine (send to spam), or p=reject (block outright). You start at none to observe, then tighten toward reject.
Third, aggregate reporting. Receivers send back XML reports showing every source sending mail as your domain — legitimate and fraudulent alike. You can validate any published record with a DMARC checker before relying on it.
DKIM vs DMARC at a glance
| Aspect | DKIM | DMARC |
|---|---|---|
| Purpose | Cryptographically sign and verify messages | Enforce policy and report on authentication results |
| What it checks | Signature validity and message integrity | Whether DKIM/SPF pass and align with the From domain |
| Where it’s published | DNS TXT record at a selector, plus a header on each message | A single DNS TXT record at _dmarc.yourdomain.com |
| Produces reports? | No | Yes — aggregate (and optional forensic) reports |
| Can act alone? | Verifies, but can’t enforce or report | No — it needs DKIM and/or SPF results to evaluate |
How they work together
DMARC never replaces DKIM; it depends on it. When a message arrives, the receiver checks the DKIM signature and the SPF result. DMARC then asks a stricter question: did at least one of those pass, and does the passing domain match the From address the recipient sees?
A message passes DMARC when DKIM authenticates the message and the signing domain aligns with the From domain (SPF can satisfy alignment the same way). If both DKIM and SPF fail alignment, DMARC applies your published policy — quarantine or reject.
This is why the two are complementary. DKIM alone proves a message is genuine and unaltered, but it does nothing when a message is missing a signature or forged. DMARC alone has no cryptographic proof to evaluate — it can only enforce and report on the results DKIM and SPF hand it. Together, DKIM supplies the trustworthy signal and DMARC turns that signal into enforcement and visibility.
Do you need both?
Yes. They solve different halves of the same problem, and neither is complete on its own.
DKIM without DMARC leaves real gaps. A valid signature proves a message wasn’t tampered with, but nothing forces receivers to reject unsigned mail, and nothing tells you who is sending in your name. Attackers can still spoof your From address with no signature at all, and you’d never see it happening.
DMARC without DKIM (or SPF) has nothing to enforce. DMARC evaluates authentication results — if no underlying method produces a passing, aligned result, DMARC can only fail every message, which breaks legitimate mail. You need at least one authentication method feeding it, and DKIM is the most durable because its signature survives forwarding better than SPF.
The practical answer for any domain sending email: deploy SPF and DKIM as the authentication layer, then layer DMARC on top to align, enforce, and monitor.
Frequently Asked Questions
What is the difference between DKIM and DMARC?
DKIM is an authentication method that attaches a cryptographic signature to each message so receivers can verify it was authorized and unaltered. DMARC is a policy-and-reporting layer that reads DKIM and SPF results, checks that they align with the visible From domain, and instructs receivers how to handle failures. One verifies; the other enforces and reports.
Is DMARC better than DKIM?
Neither is better — they do different jobs and depend on each other. DKIM provides the cryptographic proof that a message is genuine and unmodified. DMARC uses that proof, adds alignment with the From domain, enforces a policy, and sends back reports. Without DKIM, DMARC has nothing to evaluate; without DMARC, DKIM can’t enforce or monitor anything.
Can I use DMARC without DKIM?
Technically DMARC can pass on SPF alone, so it will function without DKIM. But that’s fragile: SPF breaks when mail is forwarded, while a DKIM signature survives forwarding. Relying only on SPF for alignment means legitimate forwarded mail can fail DMARC. For reliable enforcement, publish both SPF and DKIM before tightening your DMARC policy.
Does DKIM require DMARC?
No — DKIM works independently and will sign and verify messages without any DMARC record. But DKIM alone can’t force receivers to act on failures or tell you who is spoofing your domain. Adding DMARC on top turns DKIM’s verification results into enforceable policy and gives you the reporting needed to see every source sending as your domain.