SPF, DKIM, and DMARC, Explained Without the Jargon

If you send email at any scale, three acronyms will follow you everywhere: SPF, DKIM, and DMARC. They sound intimidating, but the ideas behind them are simple. Each one answers a different question about whether an email is really from you.

SPF: which servers are allowed to send for me?#

SPF (Sender Policy Framework) is a public list. You publish a DNS record that says, in effect, "these are the servers allowed to send mail on behalf of my domain." When a receiving server gets a message claiming to be from you@yourdomain.com, it checks whether the server that delivered it is on your list.

Think of it as a guest list at the door. If the sending server isn't on the list, that's a strike against the message.

The catch: SPF checks the envelope sender (the Return-Path), not the friendly "From" address your recipient sees. That's why SPF alone isn't enough — and why DKIM exists.

DKIM: was this message tampered with, and does the domain vouch for it?#

DKIM (DomainKeys Identified Mail) adds a cryptographic signature to each message. Your sending system signs the email with a private key; you publish the matching public key in DNS. The receiving server uses the public key to verify the signature.

This proves two things: the message genuinely came from someone holding your private key, and the important parts weren't altered in transit. It's a tamper-evident seal tied to your domain.

DMARC: what should happen when a message fails, and who gets told?#

SPF and DKIM each produce a pass or fail. DMARC (Domain-based Message Authentication, Reporting and Conformance) ties them to the visible "From" domain and tells receivers what to do when things don't line up: nothing, quarantine (spam folder), or reject outright. It also asks receivers to send you reports, so you can see who's sending mail as your domain — including impersonators.

DMARC is what turns SPF and DKIM from two isolated checks into a real anti-spoofing policy.

How they fit together#

A well-configured message passes SPF (sent from an authorized server), passes DKIM (carries a valid signature), and aligns — the domains in those checks match the "From" domain your recipient sees. DMARC then confirms the whole thing hangs together.

Miss one, and the major providers get suspicious. Miss DKIM entirely and much of your mail won't even reach the inbox. Gmail and Yahoo now effectively require all three for bulk senders, and the bar keeps rising.

The good news#

You set this up once per sending domain. In Buzzmark, adding a domain walks you through the exact DNS records to publish, and the dashboard shows a live verification state for SPF, DKIM, DMARC, and Return-Path so you can see green checks before you send a single message. Get those verified first — everything else in deliverability builds on top of them.