SPF authorizes sending IPs via DNS; DKIM cryptographically signs message content. They fail in different situations, which is why DMARC accepts either.
What SPF records are#
SPF (Sender Policy Framework) is a DNS TXT record that lists the servers allowed to send mail for a domain. Receivers check the connecting IP against that list during the SMTP transaction.
Why it matters#
Without SPF, any server can claim to send as your domain. With a broken SPF record, legitimate mail fails authentication and lands in spam. SPF is also one of the two alignment paths DMARC relies on.
How DKIM differs#
DKIM solves an adjacent problem. SPF authorizes sending IPs via DNS; DKIM cryptographically signs message content. They fail in different situations, which is why DMARC accepts either. In practice the two are deployed together and monitored with the same reporting.
Which to implement first#
Start with whichever your sending platform makes easiest, then add the other. Deployment order matters less than reaching a state where both pass and align with your From domain.
Frequently asked questions#
Does SPF alone stop spoofing?
No. SPF validates the envelope sender, which spoofers can set to their own domain while forging the visible From. DMARC closes that gap by requiring alignment.
What does ~all versus -all mean?
~all is softfail: receivers mark but usually accept. -all is hardfail: receivers may reject. Start with ~all, graduate to -all once DMARC data is clean.
How do I fix 'too many DNS lookups'?
Remove unused includes, replace includes with ip4/ip6 mechanisms where vendors publish static ranges, or use an SPF flattening service.