What are SPF, DKIM, and DMARC in simple terms?

SPF is a DNS policy that lists which servers may send mail for a domain used in the return path. A receiving server compares the sender’s IP address with that policy. SPF has lookup and forwarding limitations, so build the policy from the domain’s active sending services and never copy one from an unrelated domain.

DKIM adds a cryptographic signature to each outgoing message. The sending service holds the private key, while a public key is published in DNS under a selector. The receiver uses that key to verify that signed parts of the message were not changed and that the signing domain authorized the signature.

DMARC tells receivers what to do when a message using the visible From domain does not pass aligned SPF or DKIM. It can request monitoring, quarantine, or rejection and can send aggregate reports to the domain owner. Starting with reporting helps reveal every legitimate sender before a stricter policy is applied.

The three mechanisms work together, but they do not encrypt message content or prove that every authenticated message is desirable. Configure them through the actual email services, publish one valid SPF policy, rotate DKIM keys when supported, and review DMARC reports for unknown or misconfigured senders.