How does DMARC work with SPF and DKIM?

DMARC is the layer that makes SPF and DKIM actually useful for protecting your visible identity. You can have both SPF and DKIM passing and still have phishers impersonating your brand. DMARC is what closes that gap.

What SPF and DKIM each do on their own

SPF checks whether the sending server is authorized to send on behalf of the Return-Path domain, the behind-the-scenes address your recipients never see. DKIM checks that the message wasn't modified in transit and was signed by a specific domain. Both are checking technical fields, not the visible From address in the inbox.

That's the gap. A phisher can pass SPF on their own domain and pass DKIM with their own key, while showing your brand name in the From field. Recipients see your brand. Authentication passes for someone else entirely.

What DMARC adds: alignment

DMARC requires that at least one authentication method also aligns with the visible From domain. "Alignment" means the domain that passed SPF or DKIM matches the From domain your recipients see. Phishers can't pass that check without controlling your actual domain.

How the check runs, in order

1. SPF is evaluated: does the sending server match the Return-Path domain's SPF record?
2. DKIM is evaluated: is the signature valid, and what domain signed it?
3. DMARC checks alignment: does the From domain match the domain that passed SPF, or the domain in the DKIM signature?
4. If at least one method passes and aligns, DMARC passes. If neither aligns, DMARC applies your policy: p=none (monitor only), p=quarantine (spam folder), or p=reject (drop the message).

You need all three working together for real protection. SPF and DKIM without DMARC are authentication with no enforcement. DMARC without SPF or DKIM has nothing to align against.

You can check your current DMARC record and whether it's passing with our DMARC parser. If you're trying to figure out which piece of the stack is failing, the SOS hotline is free.