How SPF, DKIM, and DMARC Work Together

Understanding how the three authentication protocols interact helps you troubleshoot issues and maintain airtight email security.

The three layers

SPF verifies that the sending server is authorized. DKIM verifies that the email content is authentic and unaltered. DMARC defines what happens when either SPF or DKIM fails.

How they work in sequence

When a receiving server gets your email, it performs these checks in order

Check SPF: Is the sending server's IP authorized by the SPF record? Result: pass or fail. Check DKIM: Does the DKIM signature validate against the public key in DNS? Result: pass or fail. Check DMARC alignment: Does the domain in SPF or DKIM match the From domain? Result: pass or fail. Apply DMARC policy: Based on the DMARC policy (none, quarantine, reject), take the appropriate action on failed emails.

Alignment explained

DMARC requires "alignment" — the domain checked by SPF or DKIM must match the domain in the email's From address. If your email says it is from you@yourdomain.com("mailto:you@yourdomain.com"), then SPF or DKIM must validate for yourdomain.com specifically. This prevents a scenario where SPF passes for a different domain than the one shown to the recipient, which is a common spoofing technique.

For cold email to work properly

All three protocols must pass. SPF must pass and align. DKIM must pass and align. DMARC must find at least one passing, aligned result. When all three are green, your email has maximum credibility with the receiving server.

Verifying the full stack

Check SPF with the SPF Checker. Check DMARC with the DMARC Checker. Verify all DNS records with the DNS Checker. Fix any failures before sending.

---

Need pre-warmed inboxes ready to send today? Warm Inboxes includes free .com domains and 24/7 support. Used by agencies doing 10,000+ emails per day. Check your deliverability free →