SPF, DKIM and DMARC are three checks that mail servers run to see whether a message really came from the domain it claims. SPF lists the servers allowed to send for a domain. DKIM signs each message. DMARC checks that one of them matches the domain in the From line, and tells receivers what to do if not.
What is SPF?
SPF, the Sender Policy Framework, is defined in RFC 7208. A domain publishes, in its DNS records, which servers may send mail using its name. A receiving server compares the server that delivered a message with that list.
SPF checks the address used in the delivery itself, which people rarely see. It says nothing on its own about the From address shown at the top of the message. That gap is what DMARC closes.
What is DKIM?
DKIM, DomainKeys Identified Mail, is defined in RFC 6376. The sending domain signs each message with a private key. It publishes the matching public key in its DNS, so any receiver can check the signature. A valid signature shows that the domain took responsibility for the message and that the signed parts were not changed on the way.
What is DMARC?
DMARC stands for Domain-based Message Authentication, Reporting and Conformance. Its current specification is RFC 9989, which replaced the original RFC 7489 in May 2026. The owner of the domain in the From line publishes a policy: what receivers should do with mail that fails, and where to send reports.
A message passes DMARC when SPF or DKIM passes and the passing domain is aligned with the From domain. Relaxed alignment means both belong to the same organisation's domain, such as news.example.com and example.com. Strict alignment means they are identical. The policy says what happens on a fail: none, quarantine or reject.
Who requires SPF, DKIM and DMARC
- Google: since 1 February 2024, all senders to Gmail need SPF or DKIM. Senders of more than 5,000 messages a day need SPF, DKIM and DMARC, with the From domain aligned. Google says it began ramping up enforcement in November 2025.
- Yahoo: from February 2024, bulk senders need SPF, DKIM and a DMARC policy of at least none, and DMARC must pass.
- Microsoft: domains sending more than 5,000 messages a day to Outlook.com addresses must pass SPF and DKIM and publish DMARC. From 5 May 2025, mail that fails goes to Junk, with rejection to follow.
- US federal agencies: a 2017 directive from the Department of Homeland Security required every agency to reach a DMARC policy of reject within a year.
How to see the results on a message
In Gmail on a computer, select More next to Reply, then Show original. Google's developer documentation says SPF, DKIM and DMARC each appear on their own line there. The down arrow under the sender's name shows "Mailed by" and "Signed by". Gmail puts a question mark next to the sender's name when it could not authenticate a message.
In Outlook, a question mark on the sender's picture means Outlook could not verify the sender. Select More actions, then View, then View message details, to read the full headers.
What a pass means, and what it does not
A pass proves that the domain in the From line sent or signed the message. It does not prove that the domain is honest. A scammer who registers a lookalike domain can set up all three checks and pass them. That is how emails from scherrerconstruction.us reached Milwaukee, where the real builder uses .com. A message sent from a real, hacked mailbox passes as well, as in Pine Bluff.
A fail is a strong warning on a message that claims to come from your bank or your employer. It is not proof of fraud on its own: Microsoft notes that not every message that fails is malicious. Forwarded mail and badly configured senders fail too. Read the sender and the request as well. The seven checks for Gmail and Outlook cover both.
If you run a domain
Publish SPF and turn on DKIM signing for every service that sends mail in your name, including invoicing and newsletter tools. Then publish DMARC with a policy of none and read the reports. When only your own services appear, move to quarantine, then reject. Google's guide to setting up DMARC walks through each step.
What Antilure draws for an unauthenticated sender
Antilure reads a message's authentication results alongside its other signals. On risky mail in Gmail or Outlook, its Details panel explains the sender, including when authentication fails or when the domain imitates one you know. Download Antilure.
Sources
- RFC 7208: Sender Policy Framework (SPF) for Authorizing Use of Domains in Email, Version 1, IETF, April 2014.
- RFC 6376: DomainKeys Identified Mail (DKIM) Signatures, IETF, September 2011.
- RFC 9989: Domain-Based Message Authentication, Reporting, and Conformance (DMARC), IETF, May 2026.
- Email sender guidelines, Gmail Help, Google, checked 7 November 2026.
- Email sender guidelines FAQ, Gmail Help, Google, checked 7 November 2026.
- Sender Requirements and Recommendations, Yahoo Sender Hub, checked 7 November 2026.
- Strengthening Email Ecosystem: Outlook's New Requirements for High-Volume Senders, Microsoft Defender for Office 365 Blog, 2 April 2025, updated 30 April 2025.
- BOD 18-01: Enhance Email and Web Security, Department of Homeland Security, 16 October 2017.
- Set up DMARC, Google Workspace Help, updated 26 October 2026.
- Check if your Gmail message is authenticated, Gmail Help, Google, checked 7 November 2026.
- Security requirements, Gmail, Google for Developers, updated 3 September 2026.
- Phishing and suspicious behavior in Outlook, Microsoft Support, checked 7 November 2026.