Short answer
SPF lists the servers allowed to send email for your domain, DKIM adds a signature so tampering is detectable, and DMARC ties both to the From address you show and tells receivers what to do when checks fail. DMARC passes when SPF or DKIM passes in alignment with the From domain. Gmail, Yahoo and Outlook.com expect all three from high-volume senders.
What does each standard check?
| Standard | Checks | Lives in | Fails when |
|---|---|---|---|
| SPF (RFC 7208) | The sending server is on your allowed list | TXT record on your domain | A sender is missing, or more than 10 DNS lookups |
| DKIM (RFC 6376) | The signature matches a public key | TXT at selector._domainkey | Message altered, wrong key or no signing for your domain |
| DMARC | SPF or DKIM passed for a domain aligned with From | TXT at _dmarc | Neither passes in alignment |
How do you roll them out?
- Publish exactly one SPF record covering every service that sends as your domain.
- Set up DKIM with each provider, using custom domain authentication so the signature uses your domain.
- Publish DMARC at p=none with an rua address to receive reports.
- Fix failures shown in the reports, then move to p=quarantine and p=reject.
What do mailbox providers require?
- Google: SPF or DKIM for all senders; SPF, DKIM and DMARC for bulk senders above 5,000 messages a day to Gmail.
- Yahoo: authentication for all senders, plus DMARC and one-click unsubscribe for bulk senders.
- Microsoft: SPF and DKIM must pass and DMARC at least p=none for domains over 5,000 emails a day.
- The current DMARC reference is RFC 9989, which obsoletes RFC 7489.