SPF, DKIM and DMARC: What They Reveal and What They Don't

SPF, DKIM and DMARC are three DNS-published mechanisms that together answer a simple question: should a receiving mail server trust a message that claims to come from this domain?

SPF

Lists the IPs and hosts allowed to send mail as the domain. Checks the envelope sender, not the From: header users see.

DKIM

Cryptographic signature added by the sending infrastructure. Proves the message hasn't been modified in transit and was signed by a domain we can name.

DMARC

A policy built on SPF and DKIM. It answers: "when SPF or DKIM fails alignment, what should receivers do?" Options are none, quarantine, or reject. It also asks for aggregate reports.

Three common patterns

1. p=none for months without changes. The domain is monitoring, not enforcing. This is fine as a migration posture, weak as a permanent one.
2. SPF present but DMARC missing. SPF alone does not prevent display-name spoofing. Always pair SPF with DMARC.
3. Strict p=reject without having fixed all senders first. The most painful failure mode — legitimate mail ends up in receivers' Junk folders.

What these records do not tell you

• Whether the DMARC aggregate reports are actually being read.
• Whether the underlying mail infrastructure is well-operated.
• Whether the domain is targeted by lookalike-domain phishing.