SPF, DKIM, and DMARC Explained Without the Jargon

Email authentication is easier to understand as three related questions. Is this sender allowed to use the domain? Was the message altered in transit? And what should a receiving provider do when authentication does not line up?

SPF: who may send?

Sender Policy Framework is a DNS record that lists systems authorized to send mail for a domain. A domain should generally publish one SPF record that combines its legitimate senders. Adding a second independent SPF record can cause a permanent error, so update the existing record carefully when services change.

DKIM: does the signature match?

DomainKeys Identified Mail attaches a cryptographic signature to outgoing messages. The receiving system retrieves a public key from DNS and checks whether the signed parts still match. A valid signature helps show that the message was authorized by the signing domain and has not been changed in a way the signature covers.

DMARC: do identities align?

Domain-based Message Authentication, Reporting and Conformance checks whether SPF or DKIM authenticates a domain aligned with the visible From address. It also lets a domain owner publish a policy and request reports. Many teams begin by monitoring, reviewing legitimate senders, and tightening policy only when they understand the results.

These standards do not guarantee inbox placement: reputation, content, recipient behavior, and provider rules also matter. Keep a record of every service that sends as your domain, verify DNS after changes, and review DMARC reports before making enforcement stricter. Lipiyo Mail guides domain owners through the records needed for their own mail configuration.