TECH Signal 476
One Email, Three Identities: SPF, DKIM and DMARC Explained
↗
Illustration only Photo by Juan Pablo on Unsplash
An email contains three separate domain identities, visible From, envelope sender, and DKIM domain, each validated by its own mechanism, and DMARC requires alignment of one of these with the From address.
Engineers must configure SPF, DKIM, and DMARC records with an awareness that they protect different parts of a message; a passing SPF check does not guarantee DMARC success if the envelope domain does not align with the From domain. Misalignment can cause legitimate messages to be rejected or marked as spam, impacting deliverability for services that use third-party ESPs.
Written by elseif from the cluster below · every claim links back to a sourceThe three things worth knowing
SPF authenticates the sending IP against the envelope sender's domain, not the address shown to users.
DKIM verifies a cryptographic signature tied to a domain specified in the DKIM-Signature header, independent of the envelope or IP.
DMARC passes when either SPF or DKIM aligns the authenticated domain with the visible From domain, allowing one mechanism to compensate for the other's misalignment.
THE CLUSTER