What Are SPF, DKIM and DMARC?
SPF, DKIM and DMARC are email authentication mechanisms that use your domain and DNS to help receiving mail systems verify messages sent using your domain. They solve different parts of the problem and are commonly deployed together.
What Is SPF?
Sender Policy Framework (SPF) lets a domain publish which hosts are authorized to send mail using that domain in the relevant SMTP identities. An SPF policy is published in DNS as a TXT record.
v=spf1 include:mail.example.com ~all
A domain should have a single SPF record for a given owner name. The exact mechanisms and authorized senders depend on the mail services you actually use.
What Is DKIM?
DomainKeys Identified Mail (DKIM) adds a cryptographic signature to an email. The receiving system can retrieve the signer’s public key from DNS and verify that signature.
selector._domainkey.example.com
DKIM records are normally published below a selector-specific name such as selector._domainkey.example.com. Your mail provider usually gives you the selector and DNS record to publish.
What Is DMARC?
Domain-based Message Authentication, Reporting, and Conformance (DMARC) lets a domain publish a policy describing how receivers should handle mail that fails DMARC evaluation. It also provides reporting mechanisms for visibility into authentication results.
_dmarc.example.com
A DMARC policy is published at _dmarc.example.com. Policies can specify different handling options, including p=none, p=quarantine and p=reject, depending on the domain owner’s deployment stage and requirements.
Go beyond basic DMARC checks
DMARC aggregate reports can help you identify which servers send email using your domain and whether those messages pass authentication. Our Getting Started guide explains the setup workflow and how DMARC reporting fits into Viglar.
Explore the Getting Started guide →How Do SPF, DKIM and DMARC Work Together?
SPF
SPF answers whether the sending source is authorized for the relevant domain identity.
DKIM
DKIM provides a cryptographic signature that allows the receiving system to verify the signing domain and message signature.
DMARC
DMARC uses authentication results and domain alignment to evaluate messages using the visible From domain, then applies the published policy and can generate reports.
What Are Common SPF, DKIM and DMARC Problems?
Missing or incorrect SPF
The SPF record does not exist, contains the wrong sending services, or has been configured incorrectly. Changes to your mail provider may require an SPF update.
Broken DKIM
A selector may be missing, the public key may not match the signing system, or a mail service may be signing with a different selector than expected.
DMARC alignment or policy problems
A message can have SPF or DKIM authentication without satisfying DMARC alignment. An overly strict policy can also affect legitimate mail when all sending services have not been configured correctly.
What Should You Check?
Start by identifying every service that legitimately sends email using your domain. Then verify the SPF record, DKIM configuration and DMARC policy in DNS. After changes, test the actual mail flow and review available authentication reports rather than assuming that a published DNS record alone means email authentication is working correctly.
How Viglar Helps Monitor Email Authentication
Viglar checks DNS configuration for your domain, including SPF, DKIM and DMARC signals. It can help detect missing records, unexpected DNS changes and configuration problems before they become an email delivery or domain-security issue.
Want to check your domain?
Run a quick external check with Viglar and inspect the DNS and security signals currently visible for your domain.
Check Your DomainNeed to create or fix your records? Generate SPF, DKIM and DMARC records with Viglar.
Generate SPF, DKIM & DMARC records →