Three DNS records, three different jobs. Get one wrong and the other two can't save you.
We audit a new domain almost every week where the owner says "we have SPF set up" as if that settles the question. It doesn't. SPF, DKIM, and DMARC each check a different thing, and a domain with only one of the three configured is still wide open to the exact spoofing problem all three exist to stop.
An SPF record is a DNS TXT entry that lists the servers allowed to send mail for your domain. A receiving server gets a message claiming to be from you, checks the SPF record, and compares the sending server's IP against that list. Match, and SPF passes. No match, and it fails.
The record ends in a qualifier: ~all (soft fail, mark it suspicious) or -all (hard fail, reject servers not on the list). Most domains we inherit are stuck on ~all because someone was afraid to break something, which means SPF is checking the list but not enforcing it.
The hidden failure mode: SPF allows at most 10 DNS lookups per check. Every include: mechanism, one per third-party tool you authorize, counts against that limit, and some of those includes trigger further lookups of their own. Add a CRM, a help desk, a marketing platform, and an invoicing tool, and you can quietly blow past 10 lookups. The result is a permanent error called permerror, and SPF stops working entirely, silently, with no warning in your DNS panel.
DKIM signs each outgoing message with a private key, and publishes the matching public key in a DNS TXT record under a selector (something like s1._domainkey.yourdomain.com). The receiving server pulls that public key, verifies the signature, and confirms two things: the message came from a server holding your private key, and nothing in the signed fields changed in transit.
Two things break DKIM in practice. First, key length: a 1024-bit key still validates but is weak enough that some providers now flag it; 2048-bit is the current standard. Second, selector mismatches: if your ESP rotates signing keys and the DNS record doesn't get updated to match, every message starts failing DKIM even though signing is technically happening.
DMARC doesn't check anything new. It reads the pass/fail result from SPF and DKIM, checks that the domain in those checks aligns with the domain in the visible From address, and then tells the receiving server what to do with mail that fails: nothing (p=none), send it to spam (p=quarantine), or block it outright (p=reject).
p=none is a monitoring mode. It changes nothing about delivery, but it adds a rua address that receives aggregate reports showing every server sending mail claiming to be your domain, including shadow IT tools, old marketing platforms, and anyone actively spoofing you. Read those reports before enforcing anything.
Check your own records right now: run your domain through MXToolbox for SPF and DKIM syntax, and dmarcian's DMARC Inspector to see your current policy and whether it's enforcing anything.
SPF without DKIM breaks the moment a message gets forwarded, since forwarding changes the sending server and SPF fails even for a legitimate message. DKIM without DMARC means a failed signature doesn't stop anything, since nothing tells the receiver what a failure should mean. SPF and DKIM without DMARC alignment still allow someone to pass both checks using a visually similar domain that isn't yours. Each record closes a gap the other two leave open.
All three. SPF alone doesn't stop someone from forging your display name through a different authorized server. DKIM alone proves a message wasn't altered but doesn't tell receivers what to do if it fails. DMARC depends on SPF or DKIM passing and aligning, so it needs at least one of them configured correctly first.
SPF allows a maximum of 10 DNS lookups per check. Each include: mechanism, one per email tool you use, can itself trigger more lookups. Stack enough tools and you exceed the limit, which causes a permanent SPF failure called permerror, even though the record looks fine to the eye.
Not immediately. Start at p=none and collect aggregate reports for two to four weeks to see what's sending as your domain, including tools you forgot about. Move to p=quarantine once reports look clean, then p=reject. Jumping straight to reject risks blocking legitimate mail you didn't know existed.
Send us your domain. We'll tell you exactly what's missing, what's silently broken, and the order to fix it in.
Book a Deliverability Call →