SPF, DKIM and DMARC: how email authentication works

SPF authorises sending hosts for an envelope domain, DKIM signs selected message content with a domain key, and DMARC evaluates identifier alignment and publishes policy/reporting information. Passing one mechanism does not prove that a message is trustworthy.

What SPF, DKIM and DMARC each do

SPF checks whether the sending server is authorised by the envelope-from domain policy; DKIM verifies a cryptographic signature over selected message content; DMARC relates those results to the visible From domain through alignment rules and publishes a handling policy.

How to check authentication results

Find Authentication-Results in the message headers and inspect SPF, DKIM and DMARC separately. DMARC also depends on alignment with the visible From domain. A pass authenticates defined domain relationships; it does not prove that the message content or sender intent is trustworthy. You can cross-check the domain's DNS data with 2ip DNS response check before interpreting Authentication-Results.

Why a pass does not mean “safe email”

Technical references: RFC 7208, RFC 6376 and RFC 7489.