SPF, DKIM, DMARC: what is the difference?

All three answer one flaw: the original email protocol lets anyone type any address as the sender. SPF was first written down in 2006, DKIM in 2007, DMARC in 2015. They became everyone's business when Gmail made them mandatory for large senders in February 2024 and Microsoft followed in May 2025. If your messages land in spam today, the cause is almost always in one of the three; why your emails go to spam walks through how to find it.

Guest list, sealed envelope, house rule

Picture a letter. SPF is the guest list at your domain's door: which post offices may send letters in your name. DKIM is the sealed envelope: a signature proving nobody opened or changed the letter on the way. DMARC is the house rule: what the receiver does when the guest list or the seal fails, and where it sends a report about it.

The difference between the first two matters. SPF checks the server that sends, not the address your reader sees, which is why it often fails on forwarded mail. DKIM travels inside the message and survives forwarding. DMARC ties both to the From address: one of them has to pass for the same domain the reader sees. Without that alignment a fraudster can pass SPF for his own domain and still show your name as sender.

What is a DMARC record, line by line

Here is the set for a company on Microsoft 365 that sends its newsletter with Mailchimp, on the example domain yourcompany.com. You add them wherever your DNS lives, usually at the registrar where you registered your domain:

Three details decide whether it works. The sign before all in SPF: -all means reject anything not listed, ~all means mark it as suspect. Every include counts as a DNS lookup, and more than ten makes the whole SPF check fail, which happens fast once marketing, invoicing and support tools all send as you. And a domain has exactly one SPF record; a second one beside it breaks both. When you transfer a domain name or move your mailboxes, take all three with you.

What is a DMARC policy, and how to reach reject

DMARC has three settings. With p=none failing mail is delivered as usual, but you get reports. With p=quarantine it goes to spam. With p=reject the receiver refuses it. The safe route:

1. Publish p=none with a report address and read the reports for two to four weeks.
2. List every service that sends as your domain: mailboxes, newsletter tool, invoicing software, the contact form on your site. Give each one SPF and DKIM.
3. Move to p=quarantine, if you like with pct=25 for a quarter of your mail first.
4. Move to p=reject once the reports show nothing unexpected for a few weeks.

What Gmail and Outlook ask since 2024

Gmail has asked every sender for SPF or DKIM since 1 February 2024, and anyone sending more than 5,000 messages a day for all three, with DMARC at least at p=none. Microsoft asks the same for Outlook.com and Hotmail since 5 May 2025 and sends non-compliant mail from large senders to Junk. A weekly newsletter to a few thousand addresses stays below that daily line, but with clean records you never have to think about it. A second lock on every mailbox, two factor authentication, stops a stolen password; DMARC stops a forged sender. You need both.